CODEWITHSUNDEEP
amazon-web-servicesamazon-s3pre-signed-url
Quân Đỗ
Quân Đỗ

Reputation: 1

How to generate read-only PresignedUrl in AWS S3 Bucket

var getPreSignedUrlRequest = new GetPreSignedUrlRequest()
                    {
                        BucketName = this._appSettings.AWS_S3_IMAGE_SIGNATURE_BUCKET,
                        Key = fileKey,
                        Expires = DateTime.UtcNow.AddHours(24),
                        Verb = HttpVerb.GET,
                        // ContentType = "application/octet-stream",
                        ServerSideEncryptionMethod = ServerSideEncryptionMethod.AES256,

                    };

So I wanna create a presignedUrl to read an image in S3 bucket with read-only permission, but if i make a request like above code (even with the verb GET), I can still use this presignedUrl to Upload a new image to replace the old one. Is there any way to prevent user to overwrite an object with PresignedUrl (for read-only purpose)?

Upvotes: 0

Views: 1550

Answers (1)

RnD
RnD

Reputation: 1069

I had the same question and a lot of people couldn't explain it properly so I'll try to do that.

By creating an s3 presigned URL, you're attaching a token with the permissions of the user who created that URL. So if the user has write access, you're basically allowing public write to that object until the URL expires.

More on it here.

A possible solution is to use CloudFront's signed URLs and point them to your S3 objects.

Upvotes: 2

Related Questions