CODEWITHSUNDEEP
amazon-web-servicesamazon-s3aws-sdk
Alex Neth
Alex Neth

Reputation: 3346

Presigned S3 URL for PUT with dynamic filename / key starts with

Is it possible to PUT to S3 using a presigned key-starts-with policy to allow upload of multiple or arbitrarily named files?

This is easy using the browser-based PresignedPost technique, but I've been unable to find a way to use a normal simple PUT for uploading arbitrary files starting with the same key.

Upvotes: 1

Views: 2863

Answers (1)

Michael - sqlbot
Michael - sqlbot

Reputation: 179194

This isn't possible... not directly.

POST uploads are unique in their support for an embedded policy document, which allows logic like starts-with.

PUT and all other requests require the signature to precisely match the request, because the signature is derived entirely from observable attributes of the request itself.

One possible workaround would be to connect the bucket to CloudFront and use a CloudFront pre-signed URL with an appropriate wildcard. The CloudFront origin access identity, after validating the CloudFront URL, would actually handle signing the request in the background on its way to S3 to match the exact request. Giving the origin access identity the s3:PutObject permission in bucket policy then should allow the action.

I suggest this should work, though I have not tried it, because the CloudFront docs indicate that the client needs to add the x-amz-content-sha256 header to PUT requests for full compatibility with all S3 regions. The same page warns that any permissions you assign to the origin access identity will work (such as DELETE), so, setting the bucket policy too permissive will allow any operation to be performed via the signed URL -- CloudFront signed URLs don't restrict to a specific REST verb.

http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html

Note that there's no such concept as uploading "to" CloudFront. Uploads go through CloudFront to the origin server, S3 in this case.

Upvotes: 2

Related Questions