403 Forbidden Error in S3 REST API HEAD Request

I'm trying to make a request for a HEAD object in the S3 REST API, but I still get a 403 Forbidden error even though I have a policy setting with the required permissions on S3. The body of the response is empty, so I don't think this is a signature issue. I tried several policy changes, nothing seemed to work. I can run objects and DELETE objects just fine, only HEAD doesn't work.

Here's my bucket policy:

{
"Statement": [
    {
        "Effect": "Allow",
        "Principal": {
            "AWS": "arn:aws:iam:: 999999999999:user/User"
        },
        "Action": "s3:ListBucket",
        "Resource": "arn:aws:s3:::my-bucket"
    },
    {
        "Effect": "Allow",
        "Principal": {
            "AWS": "*"
        },
        "Action": "s3:GetObject",
        "Resource": "arn:aws:s3:::my-bucket/*"
    },
    {
        "Sid": "",
        "Effect": "Allow",
        "Principal": {
            "AWS": "arn:aws:iam::999999999999:user/User"
        },
        "Action": [
            "s3:GetObject",
            "s3:GetObjectVersion",
            "s3:DeleteObject",
            "s3:PutObject"
        ],
        "Resource": "arn:aws:s3:::my-bucket/*"
    }
]
}

      

        
        
        
      

    

Any ideas?

Update:

As Michael pointed out, it looks like this is a problem with my signature, although Im not been able to figure out what.

def generate_url options={}
options[:action] = options[:action].to_s.upcase
options[:expires] ||= Time.now.to_i + 100
file_path = "/" + @bucket_name + "/" + options[:file_name]

string_to_sign = ""
string_to_sign += options[:action]
string_to_sign += "\n\n#{options[:mime_type]}\n"
string_to_sign += options[:expires].to_s
string_to_sign += "\n"
string_to_sign += file_path

signature = CGI::escape(
  Base64.strict_encode64(
    OpenSSL::HMAC.digest('sha1', SECRET_KEY, string_to_sign)
  )
)

url = "https://s3.amazonaws.com"
url += file_path
url += "?AWSAccessKeyId=#{ACCESS_KEY}"
url += "&Expires=#{options[:expires]}"
url += "&Signature=#{signature}"
url
end

      

        
        
        
      

    

The generated string looks like this:

HEAD\n\n\n1418590715\n/video-thumbnails/1234.jpg"

      

        
        
        
      

    

Decision:

It seems that at some point while developing the PUT part of the file I actually broke GET and HEAD. I was passing in an empty string as the request body instead of not skipping anything, creating the mimic type required for the signature and breaking it because I didn't provide the mime type. I just removed the empty request body and it worked fine. Thank you Michael for pointing me in the wrong direction (I've spent so much time changing the bucket policy).