[SOLVED-ish] Laravel 11, PHP 8.3, Cant upload files to S3

[rogerio-pereira]

Hi i'm using Laravel 11, and PHP 8.3
Everything is being deployed to cloud, but i'm not able to upload any file to S3 (not really, i can upload if i change the filesystem to use my AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY, instead of bref's, check serveless.yml, filesystem.php and .env, there's some variables prefixed with CUSTOM_, those are my aws access_id and secret_access_key, those aren't being replaced by bref's access_key and secret_access_key)

Error from CloudWatch

<Error><Code>InvalidAccessKeyId</Code><Message>The AWS Access Key Id you provided does not exist in our records.</Message><AWSAccessKeyId>XXXXXXXXXXXXXXXXXXXX</AWSAccessKeyId><RequestId>XXXXX99XXXXXXXX9</RequestId><HostId>X9xX/X9xXXxXXxXxxXxxx9xx9xXxX9X9XxxxxXxxXX99x+9XxxXxxXxXxxXx9XxxXX9xXxx9XXXxXXXxX9XXX99X9Xx9Xx/x</HostId></Error>  

I run commands (inside docker container) to deploy to aws

php artisan optimize:clear
php artisan config:clear
php artisan config:cache
serverless deploy

Steps to reproduce.

1. Create a project using Laravel 11
2. Install Bref
3. Change following files

serverless.yml

useDotenv: true
service: "bref"

plugins:
    # We need to include the Bref plugin
    - ./vendor/bref/bref
    - ./vendor/bref/extra-php-extensions
    - serverless-lift

resources:
    Resources:
        # Create our S3 storage bucket using CloudFormation
        S3:
            Type: AWS::S3::Bucket
            Properties:
                BucketName: ${env:AWS_BUCKET}

        SQS:
            Type: AWS::SQS::Queue
            Properties:
                QueueName: ${env:SQS_QUEUE}

        # Create SSL certificate
        Certificate:
            Type: "AWS::CertificateManager::Certificate"
            Properties:
                DomainName: ${env:AWS_DOMAIN}
                ValidationMethod: DNS

        # Add custom domain to API Gateway
        ApiGatewayCustomDomain:
            Type: AWS::ApiGatewayV2::DomainName
            Properties:
                DomainName: ${env:AWS_DOMAIN}
                DomainNameConfigurations:
                    -   EndpointType: REGIONAL
                        CertificateArn: !Ref Certificate
                        SecurityPolicy: TLS_1_2

        # ApiGateway API, auto generated by Bref
        HttpApi:
            Type: AWS::ApiGatewayV2::Api

        HttpApiMapping:
            Type: AWS::ApiGatewayV2::ApiMapping
            Properties:
                ApiId: !Ref HttpApi
                DomainName: !Ref ApiGatewayCustomDomain
                Stage: $default

        DnsRecord:
            Type: "AWS::Route53::RecordSet"
            Properties:
                HostedZoneName: ${env:AWS_HOST}.    # Need . in the end
                Name: ${env:AWS_DOMAIN}
                Type: 'A'
                AliasTarget:
                    DNSName: !GetAtt ApiGatewayCustomDomain.RegionalDomainName
                    HostedZoneId: Z1UJRXOUMOOFQ8 #us-east-1

provider:
    name: aws
    # The AWS region in which to deploy (us-east-1 is the default)
    region: us-east-1
    runtime: provided.al2
    iam:
        role:
            statements:
                -   Effect: Allow
                    Action: 
                        - s3:*
                        - s3-object-lambda:*
                    Resource:
                        - !Sub '${S3.Arn}' # the storage bucket
                        - !Sub '${S3.Arn}/*' # and everything inside
                -   Effect: Allow
                    Action: sqs:*
                    Resource:
                        - !GetAtt SQS.Arn # the SQS queue
    # Environment variables
    environment:
        APP_ENV: local # Or use ${sls:stage} if you want the environment to match the stage
        # FILESYSTEM_DISK: s3
        FILESYSTEM_DISK: custom_s3
        AWS_BUCKET: ${env:AWS_BUCKET}
        CUSTOM_AWS_ACCESS_KEY_ID: ${env:CUSTOM_AWS_ACCESS_KEY_ID}
        CUSTOM_AWS_SECRET_ACCESS_KEY: ${env:CUSTOM_AWS_SECRET_ACCESS_KEY}
        CUSTOM_AWS_DEFAULT_REGION: ${env:CUSTOM_AWS_DEFAULT_REGION}
        CUSTOM_AWS_BUCKET: ${env:CUSTOM_AWS_BUCKET}
        # QUEUE_CONNECTION: sqs
        # SQS_PREFIX: ${env:SQS_PREFIX} 
        # SQS_QUEUE: ${env:SQS_QUEUE}

package:
    # Files and directories to exclude from deployment
    patterns:
        - '!node_modules/**'
        - '!public/storage'
        - '!resources/assets/**'
        - '!storage/**'
        - '!tests/**'

functions:
    # This function runs the Laravel website/API
    web:
        handler: Bref\LaravelBridge\Http\OctaneHandler
        runtime: php-82
        timeout: 28 # in seconds (API Gateway has a timeout of 29 seconds)
        environment:
            BREF_LOOP_MAX: 250
            # FILESYSTEM_DISK: s3
            FILESYSTEM_DISK: custom_s3
            AWS_BUCKET: ${env:AWS_BUCKET}
            CUSTOM_AWS_ACCESS_KEY_ID: ${env:CUSTOM_AWS_ACCESS_KEY_ID}
            CUSTOM_AWS_SECRET_ACCESS_KEY: ${env:CUSTOM_AWS_SECRET_ACCESS_KEY}
            CUSTOM_AWS_DEFAULT_REGION: ${env:CUSTOM_AWS_DEFAULT_REGION}
            CUSTOM_AWS_BUCKET: ${env:CUSTOM_AWS_BUCKET}
        events:
            - httpApi: '*'
        layers:
            - ${bref-extra:pgsql-php-82}

    # This function lets us run artisan commands in Lambda
    artisan:
        handler: artisan
        runtime: php-82-console
        timeout: 720 # in seconds
        environment:
            # FILESYSTEM_DISK: s3
            FILESYSTEM_DISK: custom_s3
            AWS_BUCKET: ${env:AWS_BUCKET}
            CUSTOM_AWS_ACCESS_KEY_ID: ${env:CUSTOM_AWS_ACCESS_KEY_ID}
            CUSTOM_AWS_SECRET_ACCESS_KEY: ${env:CUSTOM_AWS_SECRET_ACCESS_KEY}
            CUSTOM_AWS_DEFAULT_REGION: ${env:CUSTOM_AWS_DEFAULT_REGION}
            CUSTOM_AWS_BUCKET: ${env:CUSTOM_AWS_BUCKET}
        # Uncomment to also run the scheduler every minute
        # events:
        #     - schedule:
        #         rate: rate(1 minute)
        #         input: '"schedule:run"'
        layers:
            - ${bref-extra:pgsql-php-82}

config/filesystems.php

<?php

return [

    /*
    |--------------------------------------------------------------------------
    | Default Filesystem Disk
    |--------------------------------------------------------------------------
    |
    | Here you may specify the default filesystem disk that should be used
    | by the framework. The "local" disk, as well as a variety of cloud
    | based disks are available to your application for file storage.
    |
    */

    'default' => env('FILESYSTEM_DISK', 'local'),

    /*
    |--------------------------------------------------------------------------
    | Filesystem Disks
    |--------------------------------------------------------------------------
    |
    | Below you may configure as many filesystem disks as necessary, and you
    | may even configure multiple disks for the same driver. Examples for
    | most supported storage drivers are configured here for reference.
    |
    | Supported Drivers: "local", "ftp", "sftp", "s3"
    |
    */

    'disks' => [

        'local' => [
            'driver' => 'local',
            'root' => storage_path('app'),
            'throw' => false,
        ],

        'public' => [
            'driver' => 'local',
            'root' => storage_path('app/public'),
            'url' => env('APP_URL').'/storage',
            'visibility' => 'public',
            'throw' => false,
        ],

        's3' => [
            'driver' => 's3',
            'key' => env('AWS_ACCESS_KEY_ID'),
            'secret' => env('AWS_SECRET_ACCESS_KEY'),
            'region' => env('AWS_DEFAULT_REGION'),
            'bucket' => env('AWS_BUCKET'),
            'url' => env('AWS_URL'),
            'endpoint' => env('AWS_ENDPOINT'),
            'use_path_style_endpoint' => env('AWS_USE_PATH_STYLE_ENDPOINT', false),
            'throw' => false,
        ],

        'custom_s3' => [
            'driver' => 's3',
            'key' => env('CUSTOM_AWS_ACCESS_KEY_ID'),
            'secret' => env('CUSTOM_AWS_SECRET_ACCESS_KEY'),
            'region' => env('CUSTOM_AWS_DEFAULT_REGION'),
            'bucket' => env('CUSTOM_AWS_BUCKET'),
            'url' => env('AWS_URL'),
            'endpoint' => env('AWS_ENDPOINT'),
            'use_path_style_endpoint' => env('AWS_USE_PATH_STYLE_ENDPOINT', false),
            'throw' => false,
        ],

    ],

    /*
    |--------------------------------------------------------------------------
    | Symbolic Links
    |--------------------------------------------------------------------------
    |
    | Here you may configure the symbolic links that will be created when the
    | `storage:link` Artisan command is executed. The array keys should be
    | the locations of the links and the values should be their targets.
    |
    */

    'links' => [
        public_path('storage') => storage_path('app/public'),
    ],

];

routes/web.php

Route::get('test_upload', function () {
    LOG::info(env('AWS_BUCKET'));
    LOG::info(env('AWS_ACCESS_KEY_ID'));
    LOG::info(env('AWS_SECRET_ACCESS_KEY'));
    LOG::info(env('CUSTOM_AWS_ACCESS_KEY_ID'));
    LOG::info(env('CUSTOM_AWS_SECRET_ACCESS_KEY'));

    //DOESN'T WORK USING BREF ACCESS KEY
    try{
        $bucket = env('AWS_BUCKET');
        $now = Carbon::now()->format('Y-m-d_h-i-s');
        $key = "{$now}.txt";
        $content = 'Hello, S3 from Lambda!';
        
        $s3 = new S3Client([
            'region'  => env('AWS_DEFAULT_REGION', 'us-east-1'),
            'version' => 'latest',
            'credentials' => [
                'key'    => env('AWS_ACCESS_KEY_ID'),
                'secret' => env('AWS_SECRET_ACCESS_KEY'),
            ],
        ]);

        $result = $s3->putObject([
            'Bucket' => $bucket,
            'Key'    => $key,
            'Body'   => $content,
        ]);
        LOG::info("File uploaded successfully. ETag: " . $result['ETag']);
    } catch (AwsException $e) {
        Log::error("Error uploading file: " . $e->getMessage());
    }

    //WORK USING AWS ACCESS KEY
    try {        
        $s32 = new S3Client([
            'region'  => env('AWS_DEFAULT_REGION', 'us-east-1'),
            'version' => 'latest',
            'credentials' => [
                'key'    => env('CUSTOM_AWS_ACCESS_KEY_ID'),
                'secret' => env('CUSTOM_AWS_SECRET_ACCESS_KEY'),
            ],
        ]);

        $result = $s32->putObject([
            'Bucket' => $bucket,
            'Key'    => $key,
            'Body'   => $content,
        ]);

        LOG::info("File uploaded successfully. ETag: " . $result['ETag']);
    } catch (AwsException $e) {
        Log::error("Error uploading file: " . $e->getMessage());
    }
});

.env

APP_NAME="Bref Lambda"
APP_ENV=local
APP_KEY=my_app_key
APP_DEBUG=true
APP_TIMEZONE=UTC
APP_PORT=8080

APP_LOCALE=en
APP_FALLBACK_LOCALE=en
APP_FAKER_LOCALE=en_US

APP_MAINTENANCE_DRIVER=file
APP_MAINTENANCE_STORE=database

BCRYPT_ROUNDS=12

LOG_STACK=single
LOG_DEPRECATIONS_CHANNEL=null
LOG_LEVEL=debug

DB_CONNECTION=pgsql
DB_HOST=my_db_host
DB_PORT=5432
DB_DATABASE=my_db_db
DB_USERNAME=my_db_user
DB_PASSWORD=my_db_password

PG_ADMIN_PORT=8888
PG_ADMIN_EMAIL="[email protected]"
PG_ADMIN_PASSWORD="123456"


SESSION_LIFETIME=120
SESSION_ENCRYPT=false
SESSION_PATH=/

BROADCAST_CONNECTION=log
# FILESYSTEM_DISK=s3
FILESYSTEM_DISK=custom_s3

CACHE_PREFIX=

MEMCACHED_HOST=127.0.0.1

REDIS_CLIENT=phpredis
REDIS_HOST=redis
REDIS_PASSWORD=null
REDIS_PORT=6379

MAIL_MAILER=smtp
MAIL_HOST=mailpit
MAIL_PORT=1025
MAIL_USERNAME=null
MAIL_PASSWORD=null
MAIL_ENCRYPTION=null
MAIL_FROM_ADDRESS="[email protected]"
MAIL_FROM_NAME="${APP_NAME}"

AWS_ACCESS_KEY_ID=my_aws_access_id_is_replaced_by_bref_access_id
AWS_SECRET_ACCESS_KEY=my_aws_secret_access_key_is_replaced_by_bref_secret_access_key
AWS_DEFAULT_REGION=us-east-1
AWS_BUCKET='bref-images'

CUSTOM_AWS_ACCESS_KEY_ID=my_aws_access
CUSTOM_AWS_SECRET_ACCESS_KEY=my_aws_secret_access_key
CUSTOM_AWS_DEFAULT_REGION=us-east-1
CUSTOM_AWS_BUCKET='bref-images'

#Minio
#AWS_ENDPOINT=http://minio:9000/
#AWS_URL=http://localhost:9000/profile
#AWS_USE_PATH_STYLE_ENDPOINT=true
#MINIO_USER=minio
#MINIO_PASSWORD=Minio@AWS

VITE_APP_NAME="${APP_NAME}"
VITE_PORT=5174

WWWGROUP=1000
WWWUSER=1000

#LOCAL
# APP_URL="http://localhost:8080"
# FRONTEND_URL="http://localhost:8000"
# LOG_CHANNEL=stack
# SESSION_DRIVER=redis
# QUEUE_CONNECTION=redis
# CACHE_STORE=redis

#LIVE
APP_URL="https://api.my-domain.xyz"
FRONTEND_URL="https://frontend.my-domain.xyz"
SANCTUM_STATEFUL_DOMAINS="my-domain.xyz"  #do not include http:// or https://
LOG_CHANNEL=stderr
SESSION_DRIVER=database
SESSION_DOMAIN=".my-domain.xyz" #make sure this has the first ., this will allow different subdomains
QUEUE_CONNECTION=sqs
CACHE_STORE=database
SQS_PREFIX="https://sqs.us-east-1.amazonaws.com/999999999999"
SQS_QUEUE="bref-sqs"

#BREF
AWS_HOST='my-domain.xyz'
AWS_DOMAIN='api.my-domain.xyz'

Aditional files that might be useful

Dockerfile (added bref section)

FROM ubuntu:22.04

LABEL maintainer="Taylor Otwell"

ARG WWWGROUP
ARG NODE_VERSION=20
ARG POSTGRES_VERSION=15
ARG AWS_ACCESS_KEY_ID
ARG AWS_SECRET_ACCESS_KEY

WORKDIR /var/www/html

ENV DEBIAN_FRONTEND noninteractive
ENV TZ=UTC
ENV SUPERVISOR_PHP_COMMAND="/usr/bin/php -d variables_order=EGPCS /var/www/html/artisan serve --host=0.0.0.0 --port=80"
ENV SUPERVISOR_PHP_USER="sail"

RUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone

RUN apt-get update \
    && mkdir -p /etc/apt/keyrings \
    && apt-get install -y gnupg gosu curl ca-certificates zip unzip git supervisor sqlite3 libcap2-bin libpng-dev python2 dnsutils librsvg2-bin fswatch ffmpeg nano  \
    && curl -sS 'https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x14aa40ec0831756756d7f66c4f4ea0aae5267a6c' | gpg --dearmor | tee /etc/apt/keyrings/ppa_ondrej_php.gpg > /dev/null \
    && echo "deb [signed-by=/etc/apt/keyrings/ppa_ondrej_php.gpg] https://ppa.launchpadcontent.net/ondrej/php/ubuntu jammy main" > /etc/apt/sources.list.d/ppa_ondrej_php.list \
    && apt-get update \
    && apt-get install -y php8.3-cli php8.3-dev \
       php8.3-pgsql php8.3-sqlite3 php8.3-gd \
       php8.3-curl \
       php8.3-imap php8.3-mysql php8.3-mbstring \
       php8.3-xml php8.3-zip php8.3-bcmath php8.3-soap \
       php8.3-intl php8.3-readline \
       php8.3-ldap \
       php8.3-msgpack php8.3-igbinary php8.3-redis php8.3-swoole \
       php8.3-memcached php8.3-pcov php8.3-imagick php8.3-xdebug \
    && curl -sLS https://getcomposer.org/installer | php -- --install-dir=/usr/bin/ --filename=composer \
    && curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg \
    && echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_$NODE_VERSION.x nodistro main" > /etc/apt/sources.list.d/nodesource.list \
    && apt-get update \
    && apt-get install -y nodejs \
    && npm install -g npm \
    && npm install -g pnpm \
    && npm install -g bun \
    && curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | gpg --dearmor | tee /etc/apt/keyrings/yarn.gpg >/dev/null \
    && echo "deb [signed-by=/etc/apt/keyrings/yarn.gpg] https://dl.yarnpkg.com/debian/ stable main" > /etc/apt/sources.list.d/yarn.list \
    && curl -sS https://www.postgresql.org/media/keys/ACCC4CF8.asc | gpg --dearmor | tee /etc/apt/keyrings/pgdg.gpg >/dev/null \
    && echo "deb [signed-by=/etc/apt/keyrings/pgdg.gpg] http://apt.postgresql.org/pub/repos/apt jammy-pgdg main" > /etc/apt/sources.list.d/pgdg.list \
    && apt-get update \
    && apt-get install -y yarn \
    && apt-get install -y mysql-client \
    && apt-get install -y postgresql-client-$POSTGRES_VERSION \
    && apt-get -y autoremove \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*

RUN setcap "cap_net_bind_service=+ep" /usr/bin/php8.3

RUN groupadd --force -g $WWWGROUP sail
RUN useradd -ms /bin/bash --no-user-group -g $WWWGROUP -u 1337 sail

COPY start-container /usr/local/bin/start-container
COPY supervisord.conf /etc/supervisor/conf.d/supervisord.conf
COPY php.ini /etc/php/8.3/cli/conf.d/99-sail.ini
RUN chmod +x /usr/local/bin/start-container

#Bref
RUN npm install -g serverless && \
    npm install -g serverless-lift
RUN serverless config credentials --provider aws --key $AWS_ACCESS_KEY_ID --secret $AWS_SECRET_ACCESS_KEY 

EXPOSE 8000

ENTRYPOINT ["start-container"]

docker-compose.yml

services:
    laravel.test:
        build:
            context: ./docker/8.3
            dockerfile: Dockerfile
            args:
                WWWGROUP: '${WWWGROUP}'
                AWS_ACCESS_KEY_ID: '${AWS_ACCESS_KEY_ID}'
                AWS_SECRET_ACCESS_KEY: '${AWS_SECRET_ACCESS_KEY}'
        image: sail-8.3/app
        extra_hosts:
            - 'host.docker.internal:host-gateway'
        ports:
            - '${APP_PORT:-80}:80'
            - '${VITE_PORT:-5173}:${VITE_PORT:-5173}'
        environment:
            WWWUSER: '${WWWUSER}'
            LARAVEL_SAIL: 1
            XDEBUG_MODE: '${SAIL_XDEBUG_MODE:-off}'
            XDEBUG_CONFIG: '${SAIL_XDEBUG_CONFIG:-client_host=host.docker.internal}'
            IGNITION_LOCAL_SITES_PATH: '${PWD}'
        volumes:
            - '.:/var/www/html'
        networks:
            - sail
        depends_on:
            - pgsql
            - redis
            - minio
            - mailpit

    pgsql:
        image: 'postgres:15'
        ports:
            - '${FORWARD_DB_PORT:-5432}:5432'
        environment:
            PGPASSWORD: '${DB_PASSWORD:-secret}'
            POSTGRES_DB: '${DB_DATABASE}'
            POSTGRES_USER: '${DB_USERNAME}'
            POSTGRES_PASSWORD: '${DB_PASSWORD:-secret}'
        volumes:
            - 'sail-pgsql:/var/lib/postgresql/data'
            - './docker/pgsql/create-testing-database.sql:/docker-entrypoint-initdb.d/10-create-testing-database.sql'
        networks:
            - sail
        healthcheck:
            test:
                - CMD
                - pg_isready
                - '-q'
                - '-d'
                - '${DB_DATABASE}'
                - '-U'
                - '${DB_USERNAME}'
            retries: 3
            timeout: 5s

    pgadmin:
        image: dpage/pgadmin4
        ports:
            - "${PG_ADMIN_PORT}:80"
        environment:
            PGADMIN_DEFAULT_EMAIL: ${PG_ADMIN_EMAIL}
            PGADMIN_DEFAULT_PASSWORD: ${PG_ADMIN_PASSWORD}
        depends_on:
            - pgsql
        volumes:
            - pgadmin-data:/var/lib/pgadmin
        networks:
            - sail

    redis:
        image: 'redis:alpine'
        ports:
            - '${FORWARD_REDIS_PORT:-6379}:6379'
        volumes:
            - 'sail-redis:/data'
        networks:
            - sail
        healthcheck:
            test:
                - CMD
                - redis-cli
                - ping
            retries: 3
            timeout: 5s

    minio:
        image: 'minio/minio:latest'
        ports:
            - '${FORWARD_MINIO_PORT:-9000}:9000'
            - '${FORWARD_MINIO_CONSOLE_PORT:-8900}:8900'
        environment:
            MINIO_ROOT_USER: ${MINIO_USER}
            MINIO_ROOT_PASSWORD: ${MINIO_PASSWORD}
        volumes:
            - 'sail-minio:/data/minio'
        networks:
            - sail
        command: 'minio server /data/minio --console-address ":8900"'
        healthcheck:
            test:
                - CMD
                - curl
                - '-f'
                - 'http://localhost:9000/minio/health/live'
            retries: 3
            timeout: 5s
            
    mailpit:
        image: 'axllent/mailpit:latest'
        ports:
            - '${FORWARD_MAILPIT_PORT:-1025}:1025'
            - '${FORWARD_MAILPIT_DASHBOARD_PORT:-8025}:8025'
        networks:
            - sail
networks:
    sail:
        driver: bridge
volumes:
    sail-pgsql:
        driver: local
    sail-redis:
        driver: local
    sail-minio:
        driver: local
    pgadmin-data:

[mnapoli]

As suggested in the previous discussion, don't set AWS credentials when creating your S3Client.

Also don't set AWS_ACCESS_KEY_ID in your .env file if you upload it to Lambda.

In short: don't set AWS credentials at all, let the AWS SDK use the credentials automatically provided by Lambda, and avoid messing with this. This should work then.

[mnapoli]

Have you installed the Laravel bridge?

[rogerio-pereira]

Yes, this is my composer.json

{
    "name": "laravel/laravel",
    "type": "project",
    "description": "The skeleton application for the Laravel framework.",
    "keywords": ["laravel", "framework"],
    "license": "MIT",
    "require": {
        "php": "^8.2",
        "aws/aws-sdk-php": "^3.306",
        "bref/bref": "^2.1",
        "bref/extra-php-extensions": "^1.4",
        "bref/laravel-bridge": "^2.3",
        "intervention/image": "^3.6",
        "laravel/framework": "^11.0",
        "laravel/horizon": "^5.24",
        "laravel/sanctum": "^4.0",
        "laravel/tinker": "^2.9",
        "league/flysystem-aws-s3-v3": "^3.0"
    },
    "require-dev": {
        "fakerphp/faker": "^1.23",
        "laravel/breeze": "^2.0",
        "laravel/pint": "^1.13",
        "laravel/sail": "^1.26",
        "mockery/mockery": "^1.6",
        "nunomaduro/collision": "^8.0",
        "phpunit/phpunit": "^11.0.1",
        "spatie/laravel-ignition": "^2.4"
    },
    "autoload": {
        "psr-4": {
            "App\\": "app/",
            "Database\\Factories\\": "database/factories/",
            "Database\\Seeders\\": "database/seeders/"
        }
    },
    "autoload-dev": {
        "psr-4": {
            "Tests\\": "tests/"
        }
    },
    "scripts": {
        "post-autoload-dump": [
            "Illuminate\\Foundation\\ComposerScripts::postAutoloadDump",
            "@php artisan package:discover --ansi"
        ],
        "post-update-cmd": [
            "@php artisan vendor:publish --tag=laravel-assets --ansi --force"
        ],
        "post-root-package-install": [
            "@php -r \"file_exists('.env') || copy('.env.example', '.env');\""
        ],
        "post-create-project-cmd": [
            "@php artisan key:generate --ansi",
            "@php -r \"file_exists('database/database.sqlite') || touch('database/database.sqlite');\"",
            "@php artisan migrate --graceful --ansi"
        ]
    },
    "extra": {
        "laravel": {
            "dont-discover": []
        }
    },
    "config": {
        "optimize-autoloader": true,
        "preferred-install": "dist",
        "sort-packages": true,
        "allow-plugins": {
            "pestphp/pest-plugin": true,
            "php-http/discovery": true
        }
    },
    "minimum-stability": "stable",
    "prefer-stable": true
}

[mnapoli]

Oh I just noticed:

        # FILESYSTEM_DISK: s3
        FILESYSTEM_DISK: custom_s3

Maybe try changing the config for that custom disk in filesystems.php, from:

            'key' => env('AWS_ACCESS_KEY_ID'),
            'secret' => env('AWS_SECRET_ACCESS_KEY'),

to:

            'key' => env('AWS_ACCESS_KEY_ID'),
            'secret' => env('AWS_SECRET_ACCESS_KEY'),
            'token' => env('AWS_SESSION_TOKEN'),

[rogerio-pereira]

Same error
I also tried

'driver' => 's3',
// 'key' => env('AWS_ACCESS_KEY_ID'),
// 'secret' => env('AWS_SECRET_ACCESS_KEY'),
// 'token' => env('AWS_SESSION_TOKEN'),
'credentials' => [
    'key' => env('AWS_ACCESS_KEY_ID'),
    'secret' => env('AWS_SECRET_ACCESS_KEY'),
    'token' => env('AWS_SESSION_TOKEN')
],
'region' => env('AWS_DEFAULT_REGION'),
'bucket' => env('AWS_BUCKET'),
'url' => env('AWS_URL'),
'endpoint' => env('AWS_ENDPOINT'),
'use_path_style_endpoint' => env('AWS_USE_PATH_STYLE_ENDPOINT', false),
'throw' => false,

and

'driver' => 's3',
//'key' => env('AWS_ACCESS_KEY_ID'),
//'secret' => env('AWS_SECRET_ACCESS_KEY'),
'token' => new Aws\Token\Token(env('AWS_SESSION_TOKEN')),
'region' => env('AWS_DEFAULT_REGION'),
'bucket' => env('AWS_BUCKET'),
'url' => env('AWS_URL'),
'endpoint' => env('AWS_ENDPOINT'),
'use_path_style_endpoint' => env('AWS_USE_PATH_STYLE_ENDPOINT', false),
'throw' => false,

and

'driver' => 's3',
'key' => env('AWS_ACCESS_KEY_ID'),
'secret' => env('AWS_SECRET_ACCESS_KEY'),
'token' => new Aws\Token\Token(env('AWS_SESSION_TOKEN')),
'region' => env('AWS_DEFAULT_REGION'),
'bucket' => env('AWS_BUCKET'),
'url' => env('AWS_URL'),
'endpoint' => env('AWS_ENDPOINT'),
'use_path_style_endpoint' => env('AWS_USE_PATH_STYLE_ENDPOINT', false),
'throw' => false,

[rogerio-pereira]

The custom disk, is using my original AWS credentials, bypassing bref's access_key_id and secret_accesss_key.
The custom disk works, but using bref credentials doesn't

[rogerio-pereira]

[Hacky Solution]
I'm creating a custom s3 disk, where it uses my aws credentials, instead of Bref credentials injected into lambda.
Ideally it would be better to work with bref credentials, but i was short of time, so i'm using this hacky solution.

Had to do the same for queue (sqs) and cache (dynamodb) credentials.
My session was using database, but i believe if i was using dynamodb i would have to do the same thing