I'm not aware of any way to do this directly with the S3 API. I think you'll have to create your own lightweight API on top, like with an API Gateway and a Lambda function that essentially proxies the S3 API using a role with GetObject permissions, and that only supports the HeadObject action.
Depending on the specifics of your setup, it may be possible to do without the Lambda, using S3 at the integration endpoint directly for the API Gateway method.
There is a ListObjects and ListObjectsV2 actions against S3. These actions may need read access, but you might be able to determine file existence with 1 of these calls and maybe a combination of resource-based (in s3) and IAM based policies that allow read, but not GetObject.
Check out this to test - https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListObjects.html - ListObjectsV2 mentions that "Read access is needed", am not sure if read access implies "GetObject" action, or some other way of configuring it.
Alternatively, you could try using GetObjectAcl - that might allow you to determine if a key exists without getting access to the object itself.
Good question. If you are able to check the objects and their metadata without reading content, would that be enough?
A couple different solutions:
- Tagging the object with metadata (device, other information you have) and ensuring it's not re-writing.
- Only using ListObjects (ListObjectsV2) and non-object read permissions (GetObject). Keep in mind that ListObjectsV2 requires READ access to the Bucket.
You're right about HeadObject! The HeadObject action retrieves metadata from the object without returning the object itself. However, this requires READ Access to the object. (https://docs.aws.amazon.com/AmazonS3/latest/API/API_HeadObject.html).
Thus, if you use a combination of the IAM Actions: ListObjects and ListBucket, GetObjectTagging, GetObjectACCL (if needed) and Deny GetObject - that should take care of your use case!
How to read from CSV files in S3 that have headers?Accepted Answerasked 4 years ago
Is it possible to play audio files in Device farm, that triggers a response in an Android phone?asked 4 months ago
Data Pipeline stops processing files in S3 bucketAccepted Answerasked 10 months ago
Glue Crawler getting 403 from S3 because "ciphertext refers to a CMK that doesn't exist." (using SSE-S3, not KMS)Accepted Answerasked 5 months ago
Can we do write-object-if-not-exist in S3 similar to conditional put in Dynamo DB?asked 7 months ago
How do you use the local shadow service from a connected device in GG v2?asked a year ago
Check if files exist in S3 without read permissionsasked 9 months ago
How can I increase the number of devices that you can include in a test run in DeviceFarm?Accepted Answerasked 4 months ago
CloudFormation reference the userId that is running the Templateasked 5 months ago
Have a service running in an ECS cluster dynamically create a new service in the same clusterasked 3 months ago