How to block s3 buckets from receiving other files than images?

Question

Hello, let me start by describing what I want to achieve.

I have a flutter mobile app and I want it to be able to upload images to a S3 bucket.
My plan is to generate presigned URL for `PutObject` operation and then use it in the app. The problem here is that I want to be secured, e.g. I do not want a user to be able to upload 1GB mp3 file. I think it can be achieved by using a policy, but are the policies really secure? I mean let's analyze the following policy:
```
{
  "Version": "2012-10-17",
  "Id": "Policy1464968545158",
  "Statement": [
    {
      "Sid": "Stmt1464968483619",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::111111111111:user/exampleuser"
      },
      "Action": "s3:PutObject",
      "Resource": [
        "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*.jpg",
        "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*.png",
        "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*.gif"
      ]
    },
  ]
}
```
it looks okay, but what if an image is not `example.jpg` but just `example` without any file extension?
Is there a way to allow only certain file types without relying on file extensions?

Answer

I would think you would want to do file type validation and possibly limit max size in your flutter application.

Are you using Amplify or the straight API? Here is a link to the Amplify Flutter docs for Upload files. It might help.

https://docs.amplify.aws/lib/storage/upload/q/platform/flutter/

I would always opt for a bucket policy that is secure and any public bucket should probably be behind a CloudFront distribution.

I just tried this policy and it still allowed me to upload non-jpg file types:

```
{
    "Version": "2012-10-17",
    "Id": "Policy1464968545158",
    "Statement": [
        {
            "Sid": "Stmt1464968483619",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::111111111111:assumed-role/MyRole/MyUser"
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*.jpg",
            "Condition": {
                "Bool": {
                    "aws:SecureTransport": "true"
                }
            }
        }
    ]
}
```

How to block s3 buckets from receiving other files than images?

相關內容