为授权用户设置S3存储桶的策略

Question

I am trying to set policy for S3 bucket so the files inside could be accessible via URL for authenticated users only. The idea is to store only links instead of files in another system and when user wants to download the file, they click on the link. I expect the user has an account in AWS and I grant him the permission to download the file.

But this solution is not working for my account. I am getting error code 403 Access Denied.

Only when I set "Principals" : "*" then the file is accessible. But I need to restrict the access to registrated users only.

Could anybody help? Thank you very much in advance.

Kind regards,

Lenka

Answer 1

The important thing to understand is that you wish to grant access to authorized users . Therefore, when the user requests the file, they need to provide their authentication . If you are merely accessible the files via an anonymous link (eg s3.amazonaws.com/my-bucket/file.txt ) then Amazon S3 doesn't know who they are and will reject the request.

There are several ways this could be done:

• By calling the GetObject command from a programming language that is using an AWS SDK . Each call would be accompanied by access credentials identifying the user.
• From a web browser via a GET request that passes a hashed authorization string ( known as Signature v4 ) to identify the user
• Via an Amazon S3 Pre-Signed URL that authorizes temporary access to an object in Amazon S3 via a hashed authorization string

The most suitable solution would be to use an Amazon S3 Pre-Signed URL .

A Pre-Signed URL can be used to grant access to S3 objects as a way of "overriding" access controls. A normally private object can be accessed via a URL by appending an expiry time and signature. This is a great way to serve private content without requiring a web server.

The benefit of using a pre-signed URL is that your users do not require AWS credentials . It would be the responsibility of your application to appropriately authenticate users to determine whether they are allowed access to objects in S3. If they are granted access, then your application should generate pre-signed URLs as authenticated links to the objects. These URLs will only be valid for a limited time duration .

A pre-signed URL can also be generated via the aws s3 presign command in the AWS Command-Line Interface (CLI) .