Hi everyone 👋 I’m trying to upload a PDF to a Binary resource and then reference it in a DocumentReference. Everything seems to work fine on the Medplum side (the Binary is created and linked properly), but when I try to access the file using the generated URL, I get an XML error with the message: “InvalidKey – Unknown Key” Here is the format of the URL I’m trying to open: https://storage.uat.apneal.ai/binary/9492417c-fcf5-43db-b95d-4d07213b1f26/3c648de3-3846-4ab7-a00b-209994d60c9a?Expires=1744044970&Key-Pair-Id=XXXX&Signature=XXXX I’ve attached a screenshot of the error I’m seeing in the browser. Has anyone encountered this before? Am I missing something when generating the Binary or accessing it? Thanks in advance for your help! 🙏

Hi @reshma , @rahul1 if you have any clue on this we would be more than happy 🙂

Hi team, how did you make this Binary? If you upload a file to the patient timeline - does it work?

Hi @reshma we are using the code that is provided in this document : https://www.medplum.com/docs/charting/external-documents I indeed have the same issue if I try to create a documentReference directly from medplum administration as you can see in the screenshot or if we try to add a document in the patient timeline. Thanks for you help here 😉

Hi @Estelle , our urls at

storage.medplum.com

are called "presigned Urls" . They come signed with a short-lived key

Ok, but the issue here happens directly when the presigned-url is created. Is there something to configure on the token expiration ? We have a self host environnement !

This appears to be an issue with the Storage Public Key - can you confirm it is set correctly in your config? https://www.medplum.com/docs/self-hosting/config-settings

Following up, that's right. @thomabig I believe this is an issue with setting up the "storageBucket" during your cluster setup

Hi @reshma and @rahul1 The certificate is available in the json file. I'm not fully sure how I can check this set up of the storage bucket, I've followed the cdk script to deploy on aws. Is there a way to reset the storage bucket only ?

Hey @thomabig , can you also check that the key in your cdk config json (should look something like this) "storagePublicKey": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9[...]DKsVn8h3DsA\nJwIDAQAB\n-----END PUBLIC KEY-----", is valid in your AWS console. You can check this in your S3 bucket permissions.

Hello @finnbergquist Thanks for hoping in. My key "storagePublicKey": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0vxnWTTRcTECWyYh4PkC\nXelg5KvWXvHR[...]k1mMi2fOmSWIVN0IOaj3zlPyOicnE1SZ8APPyqlmdF97ar7d\nkQIDAQAB\n-----END PUBLIC KEY-----\n", is nowhere to be found in the permissions tab of my s3 bucket. This is the bucket policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": {
        "AWS": "*"
      },
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::storage.****.apneal.ai",
        "arn:aws:s3:::storage.****.apneal.ai/*"
      ],
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "false"
        }
      }
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity *******"
      },
      "Action": [
        "s3:GetObject*",
        "s3:GetBucket*",
        "s3:List*"
      ],
      "Resource": [
        "arn:aws:s3:::storage.***.apneal.ai",
        "arn:aws:s3:::storage.***.apneal.ai/*"
      ]
    }
  ]
}

Where am I suppose to find the key in the permission tab ? If you have a screenshot or can indicate that that would be awesome.

You can find it in CloudFront -> PublicKeys . Make sure you are looking at the right region, and if you select your key and click edit, you should be able to see it. If it does not exist, you can also create it here.

@finnbergquist Indeed for some reasons there were two keys ! I don't have the same error anymore. Now I have an error indicating that access is denied AccessDeniedAccess Denied This XML file does not appear to have any style information associated with it. The document tree is shown below. AccessDenied Access Denied ... I guess it is still some configuration about the public keys and cloudfront link to s3 !

Can you send the response to the network call when you try to upload?

Hi @finnbergquist Thank you for setting me up on the right track ! I've managed to fix the issue, I've made a step by step on how I've fixed it. Not sure if this can help you somehow.

Thank you @thomabig ! Hopefully we an incoporate this into our docs

Thank you @thomabig !