We’re running a self-hosted Medplum deployment on AWS. Uploading and storing Binary files in S3 works correctly. The files are appearing in the storage bucket. However, when we query the Binary resource through the Medplum API, the response returns a proxy presigned URL that fails to read the file. The backend logs show a Forbidden error:

p [Error]: Forbidden
    at Repository.checkResourcePermissions (/usr/src/medplum/packages/server/dist/fhir/repo.js:442:19)
    at Repository.updateResourceImpl (/usr/src/medplum/packages/server/dist/fhir/repo.js:448:38)
    at Repository.logEvent (/usr/src/medplum/packages/server/dist/fhir/repo.js:1765:18)
    at Repository.readReferences (/usr/src/medplum/packages/server/dist/fhir/repo.js:222:22)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async getSearchIncludeEntries (/usr/src/medplum/packages/server/dist/fhir/search.js:345:32)
    at async Promise.all (index 0)
    at async getExtraEntries (/usr/src/medplum/packages/server/dist/fhir/search.js:304:36)
    at async getSearchEntries (/usr/src/medplum/packages/server/dist/fhir/search.js:208:9)
    at async searchImpl (/usr/src/medplum/packages/server/dist/fhir/search.js:40:46) {
  outcome: {
    resourceType: 'OperationOutcome',
    id: 'forbidden',
    issue: [ [Object] ]
  },
  cause: undefined
}

HI @Alejandro Arias , do you have any access policies assigned to the user?

hey @rahul1 I hadn't updated my post here but it seems the problem we were having was related to this fix which I see up in the Medplum repo: https://github.com/medplum/medplum/pull/7254 our Parameter Store value

/medplum/dev/storageBaseUrl

was missing the

/binary/

suffix, even after explicitly putting it in our config file, it didn't get auto populated when we ran

npx medplum aws update-config dev

looking forward to see if when you guys merge that PR#7254 will work

Alright great! We're working on fixing some issues in our build system related to forks