title: 403 AccessDenied for Paperclip attachments uploaded to Amazon S3 using s3cmd tool
body: <p>I recently moved over a thousand Paperlclip attachments from local storage to Amazon S3 using the <a href="http://s3tools.org/s3cmd" rel="nofollow noreferrer">s3cmd tool</a>. You can find details on how I accomplished this <a href="https://stackoverflow.com/questions/20911776/migrating-from-local-paperclip-storage-to-s3">here</a>, but to summarize, I used the following command to migrate all the old attachments.</p>
  
  <pre><code>s3cmd sync my-app/public/system/ s3://mybucket 
  </code></pre>
  
  <p>I updated my codebase to make use of the new S3 bucket, I've tested the connection and everything works fine. In fact, I can upload new attachments to the remote S3 bucket through my application and view/download them no problem. However, it seems somewhere along the lines Paperclip and S3 aren't in sync with one another, all the attachments that I moved over to my s3 bucket (blurred out in the image below) are returning 403s if I try and access them through my application. But new attachments uploaded to the same bucket are loaded just fine.</p>
  
  <p><img src="https://i.stack.imgur.com/b2xxe.png" alt="permission denied for old attachments migrated to s3"></p>
  
  <p>I have an IAM group setup with the following configuration:</p>
  
  <pre><code>{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": "s3:*",
        "Resource": "arn:aws:s3:::mybucket/*"
      }
    ]
  }
  </code></pre>
  
  <p>Judging from the fact that I can upload new attachments to S3 I'm going to say the connection established just fine. I believe I setup s3cmd to connect to my bucket via a different IAM user account than the one accessing the bucket through my application. Could it perhaps be a permission issue? If so, can I change the permissions above in any way to grant access to those files?</p>
  
  <p>I'm using the <a href="https://github.com/aws/aws-sdk-ruby" rel="nofollow noreferrer">aws-sdk</a> to integrate paperclip with S3.</p>
  
  <p><strong>Edit:</strong>
  I thought it might have been an ownership issue as I uploaded the files using admin keys rather than the ones I use in my application. I purged the bucket and resynced s3cmd after configuring it to use the same keys that the application was using. I'm met with the same result, however.</p>
  
  <p><strong>Edit2:</strong>
  I can verify my permissions &amp; connection further by going into my production console for my application and interacting with my bucket manually. Everything is working perfectly fine, i.e. I can retrieve files that my browser returns 403s for.</p>
  
  <pre><code>&gt; s3 = AWS::S3.new
  =&gt; &lt;AWS::S3&gt;
  &gt; bucket = s3.buckets['mybucket']
  =&gt; #&lt;AWS::S3::Bucket:mybucket&gt;  
  &gt; bucket.exists?
  =&gt; true
  &gt; image = bucket.objects["SomeFolder/SomeImage.jpg"]
  =&gt; &lt;AWS::S3::S3Object:SomeFolder/SomeImage.jpg&gt;
  &gt; puts image.read
  =&gt; ǃ���^�D��턣�����=m������f ... machine code
  </code></pre>