S3 Upload 403 Error

Serverless Framework
,
1

Hi, i having a problem. Currently, when i facebook sign in then change profile image, invoked aws amplify s3 upload method. aws s3 deny uploaded. but when i cognito sign in then s3 upload no problem.

// s3 upload
await Storage.vault.put

// Error message
AWSS3Provider - error uploading Error: Request failed with status code 403

i think that IAM or Cognito identity Pool Setting or S3 Bucket is problem.

// serverless.yml
iamRoleStatements:

    - Effect: Allow

      Action:

        - dynamodb:DescribeTable

        - dynamodb:Query

        - dynamodb:Scan

        - dynamodb:GetItem

        - dynamodb:PutItem

        - dynamodb:UpdateItem

        - dynamodb:DeleteItem

      # Restrict our IAM role permissions to

      # the specific table for the stage

      Resource:

        - "Fn::GetAtt": [NotesTable, Arn]

        - "Fn::GetAtt": [UsersTable, Arn]

// s3-bucket.yml
Resources:

  AttachmentsBucket:

    Type: AWS::S3::Bucket

    Properties:

      # Set the CORS policy

      CorsConfiguration:

        CorsRules:

          - AllowedOrigins:

              - "*"

            AllowedHeaders:

              - "*"

            AllowedMethods:

              - GET

              - PUT

              - POST

              - DELETE

              - HEAD

            MaxAge: 3000

# Print out the name of the bucket that is created

Outputs:

  AttachmentsBucketName:

    Value:

      Ref: AttachmentsBucket

// cognito-identity-pool.yml
Resources:
  # The federated identity for our user pool to auth with
  CognitoIdentityPool:
    Type: AWS::Cognito::IdentityPool
    Properties:
      # Generate a name based on the stage
      IdentityPoolName: ${self:custom.stage}IdentityPool
      # Don't allow unathenticated users
      AllowUnauthenticatedIdentities: false
      # Link to our User Pool
      CognitoIdentityProviders:
        - ClientId:
            Ref: CognitoUserPoolClient
          ProviderName:
            Fn::GetAtt: ["CognitoUserPool", "ProviderName"]

  # IAM roles
  CognitoIdentityPoolRoles:
    Type: AWS::Cognito::IdentityPoolRoleAttachment
    Properties:
      IdentityPoolId:
        Ref: CognitoIdentityPool
      Roles:
        authenticated:
          Fn::GetAtt: [CognitoAuthRole, Arn]

  # IAM role used for authenticated users
  CognitoAuthRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Federated: "cognito-identity.amazonaws.com"
            Action:
              - "sts:AssumeRoleWithWebIdentity"
            Condition:
              StringEquals:
                "cognito-identity.amazonaws.com:aud":
                  Ref: CognitoIdentityPool
              "ForAnyValue:StringLike":
                "cognito-identity.amazonaws.com:amr": authenticated
      Policies:
        - PolicyName: "CognitoAuthorizedPolicy"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: "Allow"
                Action:
                  - "mobileanalytics:PutEvents"
                  - "cognito-sync:*"
                  - "cognito-identity:*"
                Resource: "*"

              # Allow users to invoke our API
              - Effect: "Allow"
                Action:
                  - "execute-api:Invoke"
                Resource:
                  Fn::Join:
                    - ""
                    - - "arn:aws:execute-api:"
                      - Ref: AWS::Region
                      - ":"
                      - Ref: AWS::AccountId
                      - ":"
                      - Ref: ApiGatewayRestApi
                      - "/*"

              # Allow users to upload attachments to their
              # folder inside our S3 bucket
              - Effect: "Allow"
                Action:
                  - "s3:*"
                Resource:
                  Fn::Join:
                    - ""
                    - - Fn::GetAtt: [AttachmentsBucket, Arn]
                      - "/private/"
                      - "$"
                      - "{cognito-identity.amazonaws.com:sub}/*"

# Print out the Id of the Identity Pool that is created
Outputs:
  IdentityPoolId:
    Value:
      Ref: CognitoIdentityPool

Help me…