how to download a file from s3 bucket with a temporary token in python

Question

I have a django web app and I want to allow it to download files from my s3 bucket. The files are not public. I have an IAM policy to access them. The problem is that I do NOT want to download the file on the django app server and then serve it to download on the client. That is like downloading twice. I want to be able to download directly on the client of the django app. Also, I don't think it's safe to pass my IAM credentials in an http request so I think I need to use a temporary token. I read: http://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html

but I just do not understand how to generate a temporary token on the fly. A python solution (maybe using boto) would be appreciated.

Answer 1

With Boto (2), it should be really easy to generate time-limited download URLs, should your IAM policy have the proper permissions. I am using this approach to serve videos to logged-in users from private S3 bucket.

from boto.s3.connection import S3Connection
conn = S3Connection('<aws access key>', '<aws secret key>')
bucket = conn.get_bucket('mybucket')
key = bucket.get_key('mykey', validate=False)
url = key.generate_url(86400)

This would generate a download URL for key foo in the given bucket, that is valid for 24 hours (86400 seconds). Without validate=False Boto 2 will check that the key actually exists in the bucket first, and if not, will throw an exception. With these server-controlled files it is often an unnecessary extra step, thus validate=False in the example

---

In Boto3 the API is quite different:

s3 = boto3.client('s3')

# Generate the URL to get 'key-name' from 'bucket-name'
url = s3.generate_presigned_url(
    ClientMethod='get_object',
    Params={
        'Bucket': 'mybucket',
        'Key': 'mykey'
    },
    expires=86400
)