How to provide public but exclusive access to s3 objects

Question

Hi,
I am building an application where users can upload and play audio files. I am storing them in an S3 bucket and made access public to it so that web page can access them to be played by users. However, this has a flaw that once user is logged in, other user's files are not protected and can be tried to access by changing/guessing s3url. Though I can use encryption but still urls have to be public which does not seem an ideal solution.

Any suggestions will be appreciated.

Regards,
Deepti

Accepted Answer

Hi Deepti,

You can use presigned URLs to generate a URL that can be used to access your Amazon S3 buckets. When you create a presigned URL, you associate it with a specific action. You can share the URL, and anyone with access to it can perform the action embedded in the URL as if they were the original signing user. The URL will expire and no longer work when it reaches its expiration time.

For more information about this feature, please follow the link below:
https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-presigned-url.html

Answer

Can have 2 options
1. Use presigned url for uplod to S3 - https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-presigned-url.html
2. Use Cognito for user authentication, once authenticated pass the token to API gateway and then using that create a Lambda function to generate a unique URL for that user. The 2nd options is more secure and can access only user assigned objects.

Answer

Thanks for your help. I implemented presigned URLs and made the bucket private. It is working perfectly without exposing s3 resources.  I believe this is exactly what I needed to do in this scenario. Once again thank you.

How to provide public but exclusive access to s3 objects

相關內容