Menu
Trying to understand S3...How do you limit access to a file you upload to S3? For example, from a web application, each user has files they can upload, but how do you limit access so only that user has access to that file? It seems like the query string authentication requires an expiration date and that won't work for me, is there another way to do this?
495
By default, all Amazon S3 buckets and objects are private. Only the resource owner which is the AWS account that created the bucket can access that bucket. The resource owner can, however, choose to grant access permissions to other resources and users.
Access grantedand other users with S3 permissions in your account can access them. When it comes to permissions, you can set two kinds: allow and deny permissions. If there is a rule that denies you access, regardless of any other rules that allow access, it will be denied.
To set ACL permissions for a bucketSign in to the AWS Management Console and open the Amazon S3 console at https://console.aws.amazon.com/s3/ . In the Buckets list, choose the name of the bucket that you want to set permissions for. Choose Permissions. Under Access control list, choose Edit.
Restrict access to your S3 resources. By default, all S3 buckets are private and can be accessed only by users who are explicitly granted access. Restrict access to your S3 buckets or objects by doing the following: Writing IAM user policies that specify the users that can access specific buckets and objects.
There are various ways to control access to the S3 objects:
Use the query string auth - but as you noted this does require an expiration date. You could make it far in the future, which has been good enough for most things I have done.
Use the S3 ACLS - but this requires the user to have an AWS account and authenticate with AWS to access the S3 object. This is probably not what you are looking for.
You proxy the access to the S3 object through your application, which implements your access control logic. This will bring all the bandwidth through your box.
You can set up an EC2 instance with your proxy logic - this keeps the bandwidth closer to S3 and can reduce latency in certain situations. The difference between this and #3 could be minimal, but depends your particular situation.
167
33
You will have to build the whole access logic to S3 in your applications
32
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
