CODEWITHSUNDEEP
javascriptamazon-web-servicesamazon-s3single-page-application
Ole
Ole

Reputation: 47008

Secure access directly from web app to amazon s3?

Per my review of how to setup secure access to amazon s3 buckets it looks like we first generate an IAM user and then tie a security policy allowing s3 access to that user. After that we can generate API keys for the bucket, which can authenticate request for bucket access. That's my understanding at this point, please correct me if I missed something.

I assume the API keys should be server side only (The Secret Access Key). In other words it's not safe to place these directly inside the webapp? Hence we would first have to send the data to our server, and then once there we can send it to the bucket using the API key?

Is there any way to secure access directly from a web app to an amazon s3 bucket?

Approach Summary

Per the discussion with @CaesarKabalan it sounds like the approach that would allow this is:

1) Create an IAM user that can create identities that can be authenticated via Amazon Cognito - Lets call the credentials assigned from this step Cognito Credentials.

2) The user signs in to the webapp with for example Google

3) The webapp makes a request to the webapp's server (Could be a lambda function) to signup the user with Amazon Cognito

4) The webapp now obtains credentials for the user directly from Amazon Cognito and uses these to send the data to the s3 bucket.

I think that's where we are conceptually. Now it's time to test!

Upvotes: 2

Views: 3622

Answers (1)

Caesar Kabalan
Caesar Kabalan

Reputation: 791

From your question I'm not sure what portions of your application are in AWS nor your security policies but you basically have three options:

  1. (Bad) Store your keys on the client. Depending on the scope of your deployment this might be ok. For example if each client has it's own dedicated user and bucket there probably isn't much risk, especially if this is for a private organization where you control all aspects of the access. This is the easiest but less secure. You should not use this if your app is multi-tenant. Probably move along...
  2. (Great) Use an API endpoint to move this data into your bucket. This would involve some sort of infrastructure to receive the file securely from the client then move it into S3 with the security keys stored locally. This would be similar to a traditional web app doing IO into a database. All data into S3 goes through this tier of your app. Downsides are you have to write that service, host it, and pay for bandwidth costs.
  3. (Best) Use Amazon Cognito to assign each app/user their own access key. I haven't done this personally but my understanding is you can provision each entity their own short-lived access credentials that can be renewed and you can give them access to write data straight to S3. The hard part here will be structuring your S3 buckets and properly designing the IAM credentials for your app users to ONLY be able to do exactly what you want. The upside here is the users write directly to S3 bucket, you're using all native AWS services and writing very little custom code. This I would consider the best, most secure, and enterprise class solution. Here is an example: Amazon S3: Allows Amazon Cognito Users to Access Objects in Their Bucket

Happy to answer any more questions or clarify.

Upvotes: 5

Related Questions