保护Amazon S3存储桶

Question

I create my AWS client without passind in my token or secret, like this:

AWSClientFactory.CreateAmazonS3Client()

I am then able to upload an image using:

var request = new PutObjectRequest
                {
                    BucketName = _bucketName,
                    CannedACL = S3CannedACL.PublicRead,
                    Key = key,
                    InputStream = inputStream,
                    ContentType = contentType
                };

                _amazonS3Client.PutObject(request);

I have specified the permissions for my bucket so that only I have access to write, but judging by this code I must be wronge as I am not passing in my credentials?

Have I incorectly configured my S3 bucket?

Answer 1

You have created Amazon S3 Client without passing your AWS credentials,either it create a client for the Amazon S3 Service with the credentials loaded from the application's default configuration, and if unsuccessful from the Instance Profile service on an EC2 instance.

Example App.config with credentials set.

For example : App.config with credentials set:

<?xml version="1.0" encoding="utf-8" ?> <configuration>
    <appSettings>
        <add key="AWSAccessKey" value="********************"/>
        <add key="AWSSecretKey" value="****************************************"/>
    </appSettings> </configuration>

Thus, you are able to successfully upload objects into your S3 Bucket.

See for more details : http://docs.aws.amazon.com/sdkfornet1/latest/apidocs/html/T_Amazon_AWSClientFactory.htm

Answer 2

If you follow aws documentation, you will see there is few ways to create the credential files where the AWS SDK can access it directly ( http://docs.aws.amazon.com/AWSSdkDocsNET/V2/DeveloperGuide/net-dg-config-creds.html )

Check the line that say "There are several ways to manage the profiles in the SDK Store" . Use the documentation to inspect which configuration you use.

You can test the connection by replacing the say credential file that you setup with invalid string, eg "XXXXXXXX" and try connect again to prove it.