从 AWS S3 存储桶访问文件

Question

I am using NodeJS to upload a file into my S3 bucket. As a response I receive a link to the file.

For example I receive https://my-bucket-name.s3.ap-south-1.amazonaws.com/testUpload_s.txt

The bucket does not allow public access as of now. How am I supposed to securely access the file from the bucket? I would like to know whether the the following method be safe?

1. Allow public access for bucket

2. Each file will be given a random unique name during upload

3. This file name or the response URL is stored in the database

4. When the file has to be fetched I use the link received from the upload response to access the file from the bucket

Is this approach safe? If not is there any other method to do the same?

Answer 1

There are a number of options for giving clients access to an object in S3, including:

1. make the object public
2. require the client to authenticate with AWS credentials
3. give the client a time-limited, pre-signed URL

They each serve a different use case. Use #1 if it's safe for anyone to access the file (for example the file is an image being shown on a public web site). Use #2 if the client has AWS credentials. Use #3 if you don't want to make the file public but the client does not have AWS credentials. Note with #3 that the pre-signed URL is time-limited.

Answer 2

You don't need to store URL. You can query objects in S3 bucket using file name.

For access from outside Use signed url.

https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/s3-example-presigned-urls.html