1

We have an apt repository hosted in an S3 bucket, which we use to deliver packages to workloads in EC2. On xenial, we have had no problem, however using the same configuration on bionic, we are now getting an HTTP 403 (permission denied).

I have checked that it is not the IAM profile, that it is the correct bucket, etc.

The error specifically looks like this: 

 apt-get update
Hit:1 http://eu-central-1.ec2.archive.ubuntu.com/ubuntu bionic InRelease
Hit:2 http://eu-central-1.ec2.archive.ubuntu.com/ubuntu bionic-updates InRelease            
Hit:3 http://eu-central-1.ec2.archive.ubuntu.com/ubuntu bionic-backports InRelease          
Err:4 http://<my bucket>.s3-website.eu-central-1.amazonaws.com bionic InRelease                                                        
  403  Forbidden [IP: <redacted>]
Hit:5 https://packages.microsoft.com/ubuntu/18.04/prod bionic InRelease                                                                                 
Hit:6 http://security.ubuntu.com/ubuntu bionic-security InRelease                                                     
Reading package lists... Done                      
E: Failed to fetch http://<my bucket>.s3-website.eu-central-1.amazonaws.com/dists/bionic/InRelease  403  Forbidden [IP: <redacted>]
E: The repository 'http://<my bucket>.s3-website.eu-central-1.amazonaws.com bionic InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

The source.list file looks like:

deb http://<my bucket>.s3-website.eu-central-1.amazonaws.com/ bionic main

What configuration change do I need to make to allow my EC2 instances to read the apt repository?

Thanks

Bruce Becker
  • 189
  • Would the answer(s) to this help? https://askubuntu.com/questions/732985/force-update-from-unsigned-repository-ubuntu-16-04 – Organic Marble Jul 24 '19 at 16:12
  • 1
    Thank you for that reference. I had seen it while doing research but the unauthenticated flag didn't do the trick. I have just discovered that I needed the allow-insecure flag. – Bruce Becker Jul 24 '19 at 16:32
  • 1
    Glad it helped. I'm not sure if that means this question is a duplicate or not, since your error messages were somewhat different. If it works now, consider posting an answer (answering your own question is fine on Stack Exchange) – Organic Marble Jul 24 '19 at 16:33

1 Answers1

1

The [allow-insecure=yes] option on the repo configuration line solves the problem

Bruce Becker
  • 189