Issue Fetching Rego Policy Bundle from S3 via OPAL Server in Docker Compose

[mj-1200]

I'm running into an issue with our OPAL server setup in Docker Compose for local development, while trying to fetch the Rego policy bundle from the S3 bucket. The server logs show a failure when attempting to load the bundle, possibly due to configuration issues. I am passing these env variables.

opal_server:
image: permitio/opal-server:0.8.0
depends_on:
database:
condition: service_healthy
environment:
- OPAL_BROADCAST_URI=postgres://postgres:postgres@database:5432/postgres
#configuration to fetch policy from Amazon S3 Bucket
- OPAL_POLICY_SOURCE_TYPE=API
- AWS_ACCESS_KEY_ID=
- AWS_SECRET_ACCESS_KEY=
- AWS_SESSION_TOKEN =
- OPAL_POLICY_BUNDLE_SERVER_TYPE=AWS-S3
- OPAL_POLICY_BUNDLE_SERVER_AWS_REGION=us-east-1
- OPAL_POLICY_BUNDLE_URL=AWS S3 URL
- OPAL_DATA_CONFIG_SOURCES=
- OPAL_LOG_FORMAT_INCLUDE_PID=true

ports:
  - "7002:7002"
  
  
  error 
  aiohttp.client_exceptions.ContentTypeError: 403, message='Attempt to decode JSON with unexpected mimetype: application/xml

[orweis]

Dude - did you try reading your error message?

Attempt to decode JSON with unexpected mimetype: application/xml

Your server / bucket is serving the file with a wrong mime type - XML instead of JSON

[mj-1200]

Would you happen to have a working example of how this is set up on your end (or in another environment), especially with the Docker Compose config and S3 integration?

It would be really helpful to see how it's done correctly so I can mirror that setup and avoid any misconfiguration.

Thanks a lot!

[mj-1200]

@orweis any suggestions?

[orweis]

Sorry - I don't have a working example for S3 usage here. you can try in the Slack community maybe someone else can share one.
You can also start with the generic HTTP bundle server docker compose

That said, I think the issue is pretty clear you need to change the mimetype in your S3 bucket for the bundle

[mj-1200]

I think issue is something else, even after the aws token is expired it should throw 401 , instead of 403 .hence I suspect a deeper issue.

[mj-1200]

please share slack community link to join ....