AWS 私有 S3 存储桶可从经过身份验证的 URL

Question

I am currently using pre signed URL/cookies in a private bucket in order to deliverer an access URL to a specific user from the front app.

From the front, the user clicks on a button that makes an API call to API Gateway + lambda to generate the file (or not if already exists) and then generates a valid pre signed URL for 60 seconds.

I would like to do the same thing: giving a secured URL access to a file in a private bucket BUT without expiration delay because the receiver is no longer a user but an ERP. The filename never changes, only the data in it, and each file can be download from only one ERP.

Is it possible with S3?

Answer 1

It is not possible to do this purely with S3, signed URLs must have a fixed expiry date. This can only extend as far as 7 days away.

If you want to implement this you will need to have a custom application perform this action.

You can set a longer expiry if you use CloudFront through the DateLessThan condition allowing you to set far in the future.

Alternatively you could create your own signed secret that your store in a DynamoDB table, with an API Gateway application triggering a Lambda to both validate the signed URL and if valid return the cody contents of your S3.