# Download file from AWS S3 bucket / http profile **URL:** \ **Category:** Technical Forums\ **Tags:** application-delivery\ **Created:** [June 13, 2023, 5:33pm UTC](https://community.f5.com/t/download-file-from-aws-s3-bucket-http-profile/72506 "2023-06-13T17:33:50Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![cpt\_ri\_F5](https://avatars.discourse-cdn.com/v4/letter/c/b782af/32.png) [@cpt\_ri\_F5](https://community.f5.com/u/cpt_ri_F5)\ **Post date:** [June 13, 2023, 5:33pm UTC](https://community.f5.com/t/download-file-from-aws-s3-bucket-http-profile/72506/1 "2023-06-13T17:33:50Z")
Hello,I’m trying to download a file from AWS S3 bucket (backend) through a standard VS (HTTP/iRule) but it doesn’t work. It downloads an empty/corrupt file. “_curl path/file_” works from F5. I tried to deactivate the http profile, but still ko! [(https://community.f5.com/t5/technical-forum/unable-to-download-files-with-http-profile-assigned-to-vs/td-p/44854](https://community.f5.com/topic/44854)[https://my.f5.com/manage/s/article/K00445006](https://my.f5.com/manage/s/article/K00445006)) when HTTP\_REQUEST {    if { [class match [string tolower [HTTP::uri]] contains uri-data] } {         HTTP::disable         pool MYPOOL}}when HTTP\_RESPONSE {         HTTP::disable} Someone has experienced this issue? Thank you for your help ---
**Author:** ![whisperer](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/whisperer/32/13906_2.png) [@whisperer](https://community.f5.com/u/whisperer)\ **Post date:** [June 13, 2023, 7:17pm UTC](https://community.f5.com/t/download-file-from-aws-s3-bucket-http-profile/72506/2 "2023-06-13T19:17:21Z")
So, 2 questions here: - Does datagroup ‘uri-data’ actually exist? Do you have the URI path there for the file you are looking to download? - The HTTP::disable in the HTTP\_RESPONSE will trigger on EVERY request, regardless if there is a match in the HTTP\_REQUEST. You need to specify a variable in the HTTP\_REQUEST and check it in the HTTP\_RESPONSE. I presume that when that particular URI is matched, you only then want to disable the HTTP profile for that session -- both client side (http\_request) and server side (http\_response. ---
**Author:** ![cpt\_ri\_F5](https://avatars.discourse-cdn.com/v4/letter/c/b782af/32.png) [@cpt\_ri\_F5](https://community.f5.com/u/cpt_ri_F5)\ **Post date:** [June 13, 2023, 7:43pm UTC](https://community.f5.com/t/download-file-from-aws-s3-bucket-http-profile/72506/3 "2023-06-13T19:43:28Z")
Hello, - Yes, the ‘uri-data’ datagroup exists (also tested with fixed uri in code) - Same problem, HTTP\_RESPONSE with matched URI ! _I presume that when that particular URI is matched, you only then want to disable the HTTP profile for that session -- both client side (http\_request) and server side (http\_response._ =\> I don’t know how it works, I found this solution in the two links shared, I’m interested in any other solutions. My question, is there a special configuration when trying to view or download a file ([http://VS\_F5/path\_file](http://VS_F5/path_file)) with a Standard VS ? I would also like to confirm: I access in http and the backend servers are in https, correct : no client ssl, with default serverssl ? Thank you ---
**Author:** ![whisperer](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/whisperer/32/13906_2.png) [@whisperer](https://community.f5.com/u/whisperer)\ **Post date:** [June 13, 2023, 7:46pm UTC](https://community.f5.com/t/download-file-from-aws-s3-bucket-http-profile/72506/4 "2023-06-13T19:46:58Z")
Ok, so you have a virtual server configured. What do you have configured as Pool Members? Sounds like you have a standard VS and want to server side proxy to AWS S3 buckets? Silly question, but do you have SNAT enabled on VS? Could be routing issue. ---
**Author:** ![cpt\_ri\_F5](https://avatars.discourse-cdn.com/v4/letter/c/b782af/32.png) [@cpt\_ri\_F5](https://community.f5.com/u/cpt_ri_F5)\ **Post date:** [June 13, 2023, 7:56pm UTC](https://community.f5.com/t/download-file-from-aws-s3-bucket-http-profile/72506/5 "2023-06-13T19:56:34Z")
yes, a standard VS, pool fqdn (up) wWy proxy? I just want to retrieve the file in http, curl or wget Not snat, automap (route ok) Thanks ---
**Author:** ![whisperer](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/whisperer/32/13906_2.png) [@whisperer](https://community.f5.com/u/whisperer)\ **Post date:** [June 13, 2023, 8:26pm UTC](https://community.f5.com/t/download-file-from-aws-s3-bucket-http-profile/72506/6 "2023-06-13T20:26:19Z")
Your response is confusing. “Not snat” - so this is not enabled? You are also using a pool of FQDNs. Do you have DNS enabled on the F5 and is this being properly resolved to the IP addresses that host your S3 bucket? Have you tried to perform a TCP dump on both client side and server side of the connection? Have you tried to tail -f /var/log/ltm to see if there are any errors flagged? ---
**Author:** ![cpt\_ri\_F5](https://avatars.discourse-cdn.com/v4/letter/c/b782af/32.png) [@cpt\_ri\_F5](https://community.f5.com/u/cpt_ri_F5)\ **Post date:** [June 13, 2023, 9:27pm UTC](https://community.f5.com/t/download-file-from-aws-s3-bucket-http-profile/72506/7 "2023-06-13T21:27:58Z")
Sorry, snat with automap, fqdn proprly resolved (pool up), no error /var/log/ltm, tcpdump client, serveur ok ( Syn, Syn Ack, Ack, …GET, Continuation …) Now it shows me: “the specified bucket does not exist”, But, the file exists on S3! + “curl backend/path” is ok from F5 Thanks ---
**Author:** ![Mohamed\_Ahmed\_Kansoh](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/mohamed_ahmed_kansoh/32/10886_2.png) [@Mohamed\_Ahmed\_Kansoh](https://community.f5.com/u/Mohamed_Ahmed_Kansoh)\ **Post date:** [June 13, 2023, 11:21pm UTC](https://community.f5.com/t/download-file-from-aws-s3-bucket-http-profile/72506/8 "2023-06-13T23:21:58Z")
Hi  @cpt_ri_F5  ,  Could you please disable any AWAF/ASM Policies if exists , Remove attached iRule and convert Virtual server type to performance layer 4 , If the issue is resolved so , Keep disabling ASM policy and attach http profile again , and test one more time.  If it works with http profile , so you have issue with AWAF policy and need to check yout policy and AWAF system Variables. If the Download didn’t work so you the issue is with http profile , and you need really to disable it , in this Case I recommend to add this : ```tcl when HTTP_REQUEST { if { [class match [string tolower [HTTP::uri]] contains uri-data] } { HTTP::disable log local0. "Condition True in Request" return } } when HTTP_RESPONSE { HTTP::disable log local0. "Response Action achieved" } ``` \> I addedd [Log local] as a guide to make sure that your requests match with Conditions of if statement , and to make sure that http profile really disabled.  \> I added Return to break the irule , and prefer to attach the Pool “MYPOOL” under virtual server resources. The Last thing if this available with you, Take a Packet capture for both sides ( Client and server side ) with identifing the Download file request to see why it gives you an empty/corrupted file. Follow the above steps , I hope this helps you ---
**Author:** ![whisperer](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/whisperer/32/13906_2.png) [@whisperer](https://community.f5.com/u/whisperer)\ **Post date:** [June 14, 2023, 12:53am UTC](https://community.f5.com/t/download-file-from-aws-s3-bucket-http-profile/72506/9 "2023-06-14T00:53:19Z")
Just like @Mohamed_Ahmed_Kansoh said, you really need to look closer in what variables you can eliminate, and the actual data from TCP dump. Open in wireshark, and check to see that the HTTP request leaves the F5 (sounds like it does since you get an AWS error messsage). Look at the host header, make sure it is correct. Also, look at the URI and make sure it is correct on the server side of the connection. Also, make sure you are using the same protocol -- HTTP and HTTP or HTTPS and HTTPS, if you are doing a conversion it may not work if AWS is not listening on 80 or 443. Just a few more nuggets to dig and check 😉 Definitely an interesting issue! ---
**Author:** ![cpt\_ri\_F5](https://avatars.discourse-cdn.com/v4/letter/c/b782af/32.png) [@cpt\_ri\_F5](https://community.f5.com/u/cpt_ri_F5)\ **Post date:** [June 14, 2023, 8:51am UTC](https://community.f5.com/t/download-file-from-aws-s3-bucket-http-profile/72506/10 "2023-06-14T08:51:08Z")
Hello Mohamed\_Ahmed\_Kansoh, whisperer Thank you for yor answers, - Not ASM/WAF - L4 (with/without http) : download empty/corrupted file. - L4 (with http + Mohamed\_Ahmed\_Kansoh’s iRule) : download empty/corrupted file. - Standard (with http + Mohamed\_Ahmed\_Kansoh’s iRule + no serverssl ) : \: Condition True in Request download empty/corrupted file. - Standard (with http + Mohamed\_Ahmed\_Kansoh’s iRule + serverssl ) : S3 XML Error : \NoSuchBucket\ \The specified bucket does not exist\ \: Condition True in Request \: Response Action achieved I am in http (client) and https (server), MYPOOL S3 := 443 I keep looking at the pcap… Thank you. ---
**Author:** ![cpt\_ri\_F5](https://avatars.discourse-cdn.com/v4/letter/c/b782af/32.png) [@cpt\_ri\_F5](https://community.f5.com/u/cpt_ri_F5)\ **Post date:** [June 14, 2023, 8:51am UTC](https://community.f5.com/t/download-file-from-aws-s3-bucket-http-profile/72506/11 "2023-06-14T08:51:41Z")
+ from F5 : curl http//fqdn/path\_file =\> ok curl https//fqdn/path\_file =\> ok curl http://IP\_node/path\_file =\> same S3 XML Error curl https://IP\_node/path\_file =\> SSL: certificate subject name ‘[s3.xx-xxxx-x.amazonaws.com](http://s3.xx-xxxx-x.amazonaws.com)’ does not match target host name IP\_node ---
**Author:** ![Mohamed\_Ahmed\_Kansoh](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/mohamed_ahmed_kansoh/32/10886_2.png) [@Mohamed\_Ahmed\_Kansoh](https://community.f5.com/u/Mohamed_Ahmed_Kansoh)\ **Post date:** [June 14, 2023, 9:23am UTC](https://community.f5.com/t/download-file-from-aws-s3-bucket-http-profile/72506/12 "2023-06-14T09:23:16Z")
Hi  @cpt_ri_F5  , Can you bypass bigip and try to download it directly from server ? To make sure that bigip is point of interrupt your download. Pcap may give us some insights , you may find TCP-Window-FULL and TCP-Zero-Window.  you may need to increase bigip buffer of window scale from bigip. But test first from server itself directly without bigip in path. ---
**Author:** ![cpt\_ri\_F5](https://avatars.discourse-cdn.com/v4/letter/c/b782af/32.png) [@cpt\_ri\_F5](https://community.f5.com/u/cpt_ri_F5)\ **Post date:** [June 14, 2023, 10:20am UTC](https://community.f5.com/t/download-file-from-aws-s3-bucket-http-profile/72506/13 "2023-06-14T10:20:23Z")
Hello, Resolved, add only : HTTP::header replace Host “hostname” FYI : url is : hostname.bucket.xxxxxxaws… ---
**Author:** ![whisperer](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/whisperer/32/13906_2.png) [@whisperer](https://community.f5.com/u/whisperer)\ **Post date:** [June 14, 2023, 11:28am UTC](https://community.f5.com/t/download-file-from-aws-s3-bucket-http-profile/72506/14 "2023-06-14T11:28:26Z")
Excellent. Checking headers for the win! 🙂