CODEWITHSUNDEEP
amazon-web-servicesamazon-s3boto
Kiarash
Kiarash

Reputation: 8028

accessing AWS S3 from a desktop app securely

I have data from multiple users inside a single S3 account. My desktop app has an authentication system which let the app know who the user is and which folder to access on S3. but the desktop app has the access code to the whole S3 folder.

somebody told me this is not secure since a hacker could break the request from the app to the S3 and use the credentials to download all the data.

Is this true? and if so how can I avoid it? (he said I need to a client server in the AWS cloud but this isn't clear to me... )

btw. I am using Boto python library to access S3.

thanks

Upvotes: 0

Views: 1487

Answers (2)

jamieb
jamieb

Reputation: 10033

Perfect timing! AWS just announced a feature yesterday that's likely to help you here: Variables in IAM policies.

What you would do is create an IAM account for each of your users. This will allow you to have a separate access key and secret key for each user. Then you would assign a policy to your bucket that restricts access to a portion of the bucket, based on username. (The example that I linked to above has good example of this use case).

Upvotes: 1

Kiarash
Kiarash

Reputation: 8028

I just found this:

  1. Don't store your AWS secret key in the app. A determined hacker would be able to find it eventially. One idea is that you have a web service hosted somewhere whose sole purpose is to sign the client's S3 requests using the secret key, those requests are then relayed to the S3 service. Therefore you get your users to authenticate agaist your web service using credentials that you control. To re-iterate: the clients talk directly to S3, but get their requests "rubber-stamped"/approved by you.

  2. I don't see S3 necessarily as a flat structure - if you use filesystem notation "folder/subfolder/file.ext" for the keys.

  3. Vanity URLs are supported by S3 see http://docs.amazonwebservices.com/AmazonS3/2006-03-01/VirtualHosting.html - basically the URL "http://s3.amazonaws.com/mybucket/myfile.ext" becomes "http://mybucket.s3.amazonaws.com/myfile.ext" and you can then setup a CNAME in your DNS that maps "www.myname.com" to "mybucket.s3.amazonaws.com" which results in "http://www.myname.com/myfile.ext"

Upvotes: 2

Related Questions