403 error when hitting s3 presigned url

Thank you for reaching out to us.

If the issue only occurs on specific machines or networks, it is likely related to a network or security configuration. For example, the connection might be blocked by a proxy, firewall, or security software.

You need to contact your IT support team to verify the network or security settings.

Hi @Jirapongse ,

I also have this as the response text along w/ the 403 status code. This is definitely an S3 response, so you guys are definitely rejecting me.

<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>8EWDCA8AWRBG121F</RequestId><HostId>GVz8Fut60jG5Xgm51JO3NBS/4t7QMJ/Ow0bORhTS1MmprL0b5Reth3c4Y+SxUEnw6jeo+x+cRtWDGkxsYaqouCinHi4je5bP</HostId></Error>

I suspect you have an IP or Network-based restriction in your s3 bucket policy, based on this error and the fact that I was able to download it locally.

The code works fine on your AWS environment and works fine on your desktop. I tested the get_bearer_token, get_file_download_url, and download_file_from_s3_url functions and the code also works fine on my machine.

Could you please clarify which machine and network are experiencing issues? Is it the machine connected to your company network?

I can't access the AWS to verify the S3 bucket policy so I submitted an issue on your behalf to the TM3 support team to verify this. The case number is 15379111. The support team will contact you regarding this issue.

Tantana_S

This case has been escalated to RDP technical support teams in another channel. Below are our findings for your request @ 2025-10-27T16:52:34.869Z UTC.

From CFS side, your requests hit their API without 'doNotRedirect=true' @ 16:52:34 and 16:54:58 . That means your requests were re-directed to s3 file rather than getting a pre-signed URL.
From S3 log of TM3 bucket,

- I found 2 requests got rejected with 403 code @ 16:52:34 and 16:54:58. However, I'm not sure if they were your requests as requester's ID seems to be other internal service of RDP and it didn't contain credential to access the file.

- In the other hand, I found a successful request on the same file @ 16:54:59. (This might be Domenic's request as he told me that he replicated your request around this time.)

- Those requests came from different remoteIP addresses
IP 10.102.xxx.xxx for request @ 16:52:34 and 16:54:58
IP 192.175.xxx.xxx for request @ 16:54:59

By the way, could you share your log file for this particular request @ 2025 -10-27T16:52:34.869Z UTC ?

@Jirapongse I'm connecting from our AWS network. I have redirects turned off, same error. I've included the timestamp of the failure below

https://api.refinitiv.com/file-store/v1/files/{file_id}/stream?doNotRedirect=true
response = requests.get(url, params=params, headers=headers, verify=False, allow_redirects=False)

2025-10-30T15:33:44.837Z

<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>5QYKTQCKCQC533TH</RequestId><HostId>q+uWxBGlSooqW9mDksCTUT1+yR3CC7s9tTvjNiF4QwX6JUjTCkHZsF+W9zggRoecVmtCoBzJH18=</HostId></Error>

How did you use those function?

First, you need to call the get_file_download_url method with the token and file-id to get a S3 URL.

s3_url = get_file_download_url(token, '<file-id>')
s3_url

Then, use the S3 URL with the download_file_from_s3_url method to download a file.

download_file_from_s3_url(s3_url, "test.csv.gz")

You may use the following code to enable the debug log in the requests library .

import logging
import http.client as http_client

# Enable HTTPConnection debug level
http_client.HTTPConnection.debuglevel = 1

# Configure the logging system
logging.basicConfig()
logging.getLogger().setLevel(logging.DEBUG)

# Set the logger for requests.packages.urllib3 to DEBUG level
requests_log = logging.getLogger("requests.packages.urllib3")
requests_log.setLevel(logging.DEBUG)
requests_log.propagate = True # Ensure messages are passed to the root logger

Hi @Jirapongse , that is what I am doing. Please review the code attached to my first comment in this thread.

I am confident there is no code issue, it is an access issue where your S3 bucket is rejecting my presigned url, as evidenced by the S3 Access Denied message I shared earlier.

Please engage the team that is responsible for that S3 bucket to review the access denial at the timestamp I'd provided to let me know why my presigned url did not work.