CODEWITHSUNDEEP
amazon-web-servicesamazon-s3amazon-iam
Joel Hager
Joel Hager

Reputation: 3440

How to change user 'role' per request in Amazon AWS S3 bucket?

I'm not sure if this is the appropriate use case, so please tell me what to look for if I'm incorrect in my assumption of how to do this.

What I'm trying to do:

I have an s3 bucket with different 'packs' that users can download. Upon their purchase, they are given a user role in Wordpress. I have an S3 browser set up via php that makes requests to the bucket for info.

Based on their 'role', it will only show files that match prefix (whole pack users see all, single product people only see single product prefix).

In that way, the server will be sending the files on behalf of the user, and changing IAM roles based on the user's permission level. Do I have to have it set that way? Can I just analyze the WP role and specify and endpoint or query that notes the prefixes allowed?

Pack users see / Individual users see /--prefix/ If that makes sense

Thanks in advance! I've never used AWS, so this is all new to me. :)

Upvotes: 1

Views: 338

Answers (2)

John Rotenstein
John Rotenstein

Reputation: 269901

There are basically three ways you can grant access to private content in Amazon S3.

Option 1: IAM credentials

You can add a policy to an IAM User, so that they can access private content. However, such credentials should only be used by staff in your own organization. it should not be used to grant access to application users.

Option 2: Temporary credentials via STS

Your application can generate temporary credentials via the AWS Security Token Service. These credentials can be given specific permissions and are valid for a limited time period. This is ideal for granting mobile apps access to Amazon S3 because they can communicate directly with S3 without having to go via the back-end app. The credentials would only be granted access to resources they are permitted to use.

These types of credentials can also be used by web applications, where the web apps make calls directly to AWS services (eg from Node/JavaScript in the browser). However, this doesn't seem suitable for your WordPress situation.

Option 3: Pre-Signed URLs

Imagine a photo-sharing application where users can access their private photos, and users can also share photos with other users. When a user requests access to a particular photo (or when the back-end app is creating an HTML page that uses a photo), the app can generate a pre-signed URL that grants temporary access to an Amazon S3 object.

Each pre-signed URL gives access only to a single S3 object and only for a selected time period (eg 5 minutes). This means that all the permission logic for whether a user is entitled to access a file can be performed in the back-end application. When the back-end application provides a pre-signed URL to the user's browser, the user can access the content directly from Amazon S3 without going via the back-end.

See: Amazon S3 pre-signed URLs

Your situation sounds suitable for Option #3. Once you have determined that a user is permitted to access a particular file in S3, it can generate the pre-signed URL and include it as a link (or even in <img src=...> tags). The user can then download the file. There is no need to use IAM Roles in this process.

Upvotes: 2

mcfinnigan
mcfinnigan

Reputation: 11638

This sounds too complex. It's possible to do with AWS STS but it would be extremely fragile.

I presume you're hiding the actual S3 bucket from end users and are streaming through your php application? If so, it makes more sense to do any role-based filtering in the php application as you have far more logic available to you there - IAM is granular, but restrictions to resources in S3 is going to be funky and there's always a chance you'll get something wrong and expose the incorrect downloads.

Rather do this inside your app:

  1. establish the role you've granted
  2. issue the S3 ls command filtered by the role - i.e. if the role permits only --prefix, issue the ls command so that it only lists files matching --prefix
  3. don't expose files in the bucket globally - only your app should have access to the S3 bucket - that way people also can't share links once they've downloaded a pack.

this has the added benefit of not encoding your S3 bucket structure in IAM, and keeps your decision logic isolated to code.

Upvotes: 1

Related Questions