OpenAPI Spec in S3 Bucket with IP restriction

💬 Queries and Resources
1

I’m trying to set up a REST API Resource in Retool Cloud using an OpenAI spec, which is hosted in an AWS S3 bucket. I don’t want this spec to be publicly available; that’s why I want so restrict access to just a few IP addresses using a bucket policy.
For now, I’ve set up the bucket permissions as wide as possible using the access policy JSON below, and it works as I can access the file from both my home and my office:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowAll",
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::mybucket",
                "arn:aws:s3:::mybucket/*"
            ],
            "Condition": {
                "IpAddress": {
                    "aws:SourceIp": "0.0.0.0/0"
                }
            }
        }
    ]
}

When I try to load the spec when setting up the Resource in Retool, I get this error:

This URL requires authentication. If the spec is behind auth, try downloading it from your API provider's dev portal and hosting it somewhere accessible.

Any idea what could cause the error? Happy to share the spec URL in a DM.

P.S. A feature request as well: I’d love to be able to paste the OpenAPI Spec JSON contents into ReTool, so I don’t need to jump hoops just to keep my spec from remaining private.

1 Like
4

Bump - does anyone have a clue?

5

Thanks for reaching out, @felixHedge! Do you mind sharing the URL for your spec? Feel free to DM me privately.

Something is definitely causing the request from the Retool backend to return a 401 or 403, even though your bucket policy looks fine. Have you explicitly disabled the Block Public Access bucket setting?

6

:white_check_mark: I re-verified that Block Public Access has explicitly been disabled for the bucket.

I’ve sent the URL in a DM.

1 Like
7

To anybody following this thread - we were able to circumvent this issue by setting the outbound Retool region on the resource to us-west-2, overwriting the default of eu-central-1.

It's still not clear why the spec was unreachable in the first place - whether the request died in Retool's infrastructure or was somehow excluded by the bucket policy - but I've let the team know to keep an eye out for similar failure modes and will report back here if there is anything meaningful to share.

1 Like