Answers: <p>I'd say you can:</p>
  
  <ol>
  <li><p>Using pip, install aws-cli for the www-data user specifically. 
  Example:</p>
  
  <p>pip install awscli --user</p></li>
  <li><p>Copying aws binary to some folder (for example awsonlybin) where it is the only command there and then adding the path of this folder to the www-data user's PATH. Example:</p>
  
  <p>export PATH=$PATH:/usr/local/awsonlybin</p></li>
  </ol>
  
  <p>In addition to that you should also do one of the following options:</p>
  
  <ul>
  <li><p>Create an IAM user and access and secret keys and attach a relevant IAM policy to that user and then configure awscli to use that access key and configure them under the www-data user.</p></li>
  <li><p>Create an IAM role and attach a relevant policy to that role and attach the role to that instance.</p></li>
  </ul>
  
Answers: CC BY-SA 4.0
Answers: 2019-12-12T10:42:19.393Z
Answers: 2019-12-12T10:42:19.393Z
Answers: Itai Ganot
Body: <p>I can successfully upload a file to my S3 bucket using the AWS cli version 1 with my normal linux user. However, I'm having trouble doing the same with Apache2's www-data.</p>
  
  <p>I have a personal project where I have a web form and after submission, I use shell_exec to run some shell commands. I've tried the following command but it does not seem to work and I'm not getting any errors so debugging is a bit hard:</p>
  
  <pre><code>shell_exec('/home/pi/./local/bin/aws s3 cp /path/to/test.txt s3://s3-bucket-name/');
  </code></pre>
  
  <p>If it makes any difference, I'm doing this on a Raspberry Pi. I'm suspecting it has something to do with the fact that AWS CLI has been installed under the normal user I use and www-data cannot access it.</p>
  
  <p>Any suggestions?</p>
  
  <p>Edit: One solution I found was to use allow www-data to run commands with another user without prompting for password. So this worked then:</p>
  
  <pre><code>shell_exec('sudo -u pi /home/pi/.local/bin/aws s3 cp /path/to/test.txt s3://s3-bucket-name/');
  </code></pre>
  
Comments: CC BY-SA 4.0
Comments: 2019-12-11T09:27:30.093Z
Comments: What about creating a cron job that runs a script that is able to post a file from a folder rather than running it inside apache2?
Comments: 030
Comments: CC BY-SA 4.0
Comments: 2019-12-11T12:34:38.407Z
Comments: Thanks for the suggestion however, I would prefer a way that triggers once the form is submitted, instead of a timed cron job. Any security issues related to using Apache2 for this is irrelevant as this will never be "live". But I'll keep the cron job option in my mind if nothing else works!
Comments: user2539784
Comments: CC BY-SA 4.0
Comments: 2019-12-11T12:47:32.247Z
Comments: You appear to be calling [`shell_exec()`](https://www.php.net/manual/en/function.shell-exec.php) in void context. My PHP is rusty but `$result = shell_exec(...); echo $result;` should give you the output.  You might also, from the command prompt, run `sudo su - www-data` to make a hard switch to that user and then see what happens when you manually run aws-cli as the www-data user.
Comments: Michael - sqlbot
Comments: CC BY-SA 4.0
Comments: 2019-12-11T13:41:14.730Z
Comments: Thanks, will have a look at those! I came up with a solution that isn't ideal but since it's a personal project, it doesn't matter!
Comments: user2539784
Tags: <amazon-s3>
Title: How to run aws cli with www-data?
UserDisplayName: user2539784
ThreadText: # How to run aws cli with www-data?
  
  (Asked by: username_0 on 2019-12-11)
  
  I can successfully upload a file to my S3 bucket using the AWS cli version 1 with my normal linux user. However, I'm having trouble doing the same with Apache2's www-data.
  
  I have a personal project where I have a web form and after submission, I use shell\_exec to run some shell commands. I've tried the following command but it does not seem to work and I'm not getting any errors so debugging is a bit hard:
  
  ```
  shell_exec('/home/pi/./local/bin/aws s3 cp /path/to/test.txt s3://s3-bucket-name/');
  
  ```
  
  If it makes any difference, I'm doing this on a Raspberry Pi. I'm suspecting it has something to do with the fact that AWS CLI has been installed under the normal user I use and www-data cannot access it.
  
  Any suggestions?
  
  Edit: One solution I found was to use allow www-data to run commands with another user without prompting for password. So this worked then:
  
  ```
  shell_exec('sudo -u pi /home/pi/.local/bin/aws s3 cp /path/to/test.txt s3://s3-bucket-name/');
  
  ```
  
  **Tags:** amazon-s3
  
  > **Comments:**
  > **username_1**: What about creating a cron job that runs a script that is able to post a file from a folder rather than running it inside apache2?  
  > **username_0**: Thanks for the suggestion however, I would prefer a way that triggers once the form is submitted, instead of a timed cron job. Any security issues related to using Apache2 for this is irrelevant as this will never be "live". But I'll keep the cron job option in my mind if nothing else works!  
  > **username_2**: You appear to be calling [`shell_exec()`](https://www.php.net/manual/en/function.shell-exec.php) in void context. My PHP is rusty but `$result = shell_exec(...); echo $result;` should give you the output.  You might also, from the command prompt, run `sudo su - www-data` to make a hard switch to that user and then see what happens when you manually run aws-cli as the www-data user.  
  > **username_0**: Thanks, will have a look at those! I came up with a solution that isn't ideal but since it's a personal project, it doesn't matter!  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_3 on 2019-12-12. Score: 1
  
  I'd say you can:
  
  1. Using pip, install aws-cli for the www-data user specifically.
     Example:
  
     pip install awscli --user
  2. Copying aws binary to some folder (for example awsonlybin) where it is the only command there and then adding the path of this folder to the www-data user's PATH. Example:
  
     export PATH=$PATH:/usr/local/awsonlybin
  
  In addition to that you should also do one of the following options:
  
  * Create an IAM user and access and secret keys and attach a relevant IAM policy to that user and then configure awscli to use that access key and configure them under the www-data user.
  * Create an IAM role and attach a relevant policy to that role and attach the role to that instance.
  
  
  ---
  
  