1

I can successfully upload a file to my S3 bucket using the AWS cli version 1 with my normal linux user. However, I'm having trouble doing the same with Apache2's www-data.

I have a personal project where I have a web form and after submission, I use shell_exec to run some shell commands. I've tried the following command but it does not seem to work and I'm not getting any errors so debugging is a bit hard:

shell_exec('/home/pi/./local/bin/aws s3 cp /path/to/test.txt s3://s3-bucket-name/');

If it makes any difference, I'm doing this on a Raspberry Pi. I'm suspecting it has something to do with the fact that AWS CLI has been installed under the normal user I use and www-data cannot access it.

Any suggestions?

Edit: One solution I found was to use allow www-data to run commands with another user without prompting for password. So this worked then:

shell_exec('sudo -u pi /home/pi/.local/bin/aws s3 cp /path/to/test.txt s3://s3-bucket-name/');
Improve this question
4
  • What about creating a cron job that runs a script that is able to post a file from a folder rather than running it inside apache2?
    – 030
    Dec 11, 2019 at 9:27
  • Thanks for the suggestion however, I would prefer a way that triggers once the form is submitted, instead of a timed cron job. Any security issues related to using Apache2 for this is irrelevant as this will never be "live". But I'll keep the cron job option in my mind if nothing else works!
    – user2539784
    Dec 11, 2019 at 12:34
  • You appear to be calling shell_exec() in void context. My PHP is rusty but $result = shell_exec(...); echo $result; should give you the output. You might also, from the command prompt, run sudo su - www-data to make a hard switch to that user and then see what happens when you manually run aws-cli as the www-data user.
    – Michael - sqlbot
    Dec 11, 2019 at 12:47
  • Thanks, will have a look at those! I came up with a solution that isn't ideal but since it's a personal project, it doesn't matter!
    – user2539784
    Dec 11, 2019 at 13:41

1 Answer 1

Reset to default
1

I'd say you can:

  1. Using pip, install aws-cli for the www-data user specifically. Example:

    pip install awscli --user

  2. Copying aws binary to some folder (for example awsonlybin) where it is the only command there and then adding the path of this folder to the www-data user's PATH. Example:

    export PATH=$PATH:/usr/local/awsonlybin

In addition to that you should also do one of the following options:

  • Create an IAM user and access and secret keys and attach a relevant IAM policy to that user and then configure awscli to use that access key and configure them under the www-data user.

  • Create an IAM role and attach a relevant policy to that role and attach the role to that instance.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.