CODEWITHSUNDEEP
amazon-web-servicesamazon-s3
apdm
apdm

Reputation: 1330

How can I allow a 3rd party file upload to a private S3 bucket without using IAM?

Can I allow a 3rd party file upload to an S3 bucket without using IAM? I would like to avoid the hassle of sending them credentials for an AWS account, but still take advantage of the S3 UI. I have only found solutions for one or the other.

The pre-signed url option sounded great but appears to only work with their SDKs and I'm not about to tell my client to install python on their computer to upload a file.

The browser based upload requires me to make my own front end html form and run in on a server just to upload (lol).

Can I not simply create a pre-signed url which navigates the user to the S3 console and allows them to upload before expiration time? Of course, making the bucket public is not an option either. Why is this so complicated!

Upvotes: 2

Views: 8149

Answers (2)

vedat
vedat

Reputation: 1309

you could deploy a lambda function to call "signed URL" then use that URL to upload the file. here is an example

https://aws.amazon.com/blogs/compute/uploading-to-amazon-s3-directly-from-a-web-or-mobile-application/

Upvotes: 1

John Rotenstein
John Rotenstein

Reputation: 269410

Management Console

The Amazon S3 management console will only display S3 buckets that are associated with the AWS account of the user. Also, it is not possible to limit the buckets displayed (it will display all buckets in the account, even if the user cannot access them).

Thus, you certainly don't want to give them access to your AWS management console.

Pre-Signed URL

Your user does not require the AWS SDK to use a pre-signed URL. Rather, you must run your own system that generates the pre-signed URL and makes it available to the user (eg through a web page or API call).

Web page

You can host a static upload page on Amazon S3, but it will not be able to authenticate the user. Since you only wish to provide access to specific people, you'll need some code running on the back-end to authenticate them.

Generate...

You ask: "Can I not simply create a pre-signed url which navigates the user to the S3 console and allows them to upload before expiration time?"

Yes and no. Yes, you can generate a pre-signed URL. However, it cannot be used with the S3 console (see above).

Why is this so complicated?

Because security is important.

So, what to do?

A few options:

  • Make a bucket publicly writable, but not publicly readable. Tell your customer how to upload. The downside is that anyone could upload to the bucket (if they know about it), so it is only security by obscurity. But, it might be a simple solution for you.
  • Generate a very long-lived pre-signed URL. You can create a URL that works for months or years. Provide this to them, and they can upload (eg via a static HTML page that you give them).
  • Generate some IAM User credentials for them, then have them use a utility like the AWS Command-Line Interface (CLI) or Cloudberry. Give them just enough credentials for upload access. This assumes you only have a few customers that need access.

Bottom line: Security is important. Yet, you wish to "avoid the hassle of sending them credentials", nor do you wish to run a system to perform the authentication checks. You can't have security without doing some work, and the cost of poor security will be much more than the cost of implementing good security.

Upvotes: 10

Related Questions