how to assign paperclip to file on aws using aws sdk

Question

I have been able to have third party clients upload files directly to AWS s3 and then process those files with paperclip with the following line in the model:

my_object.file_attachment = URI.parse(URI.escape(my_bucket.s3.amazonaws.com/whatever.ext))

That line downloads the file, processes it and then saves it appropriately. The problem is, in order for that line to work, I have to provide anonymous read privileges for the upload location. So my question is: How do avoid that? My thought is to use the aws-sdk to download the file - so I have been trying stuff like:

file = Tempfile.new('temp', :encoding => 'ascii-8bit')
bucket.objects[aws_key].read do |chunk|
  file.write chunk
end
my_object.file_attachment = file

and variations on that theme, but nothing is working so far. Any insights would be most helpful.

Solution I am not very happy with

You can generate a temporary privileged URL using the AWS SDK:

s3 = AWS::S3.new
bucket = s3.buckets['bucket_name']
my_object.file_attachment = bucket.objects['relative/path/of/uploaded/file.ext'].url_for(:read)

Answer 1

As @laertiades says in his amended question, one solution is to create a temporary, pre-signed URL using the AWS SDK.

AWS SDK version 1

In AWS SDK version 1, that looks like this:

s3 = AWS::S3.new
bucket = s3.buckets['bucket_name']
my_object.file_attachment = bucket.objects['relative/path/of/uploaded/file.ext'].url_for(:read)

AWS documentation: http://docs.aws.amazon.com/AWSRubySDK/latest/AWS/S3/S3Object.html#url_for-instance_method

AWS SDK version 2

In AWS SDK version 2, it looks like this with the optional expires_in parameter (credit to this answer on another question):

presigner = Aws::S3::Presigner.new
my_object.file_attachment = presigner.presigned_url(:get_object, # get_object method means read-only
                              bucket: 'bucket-name',
                              key: "relative/path/of/uploaded/file.ext",
                              expires_in: 10.minutes.to_i # time should be in seconds
                              ).to_s

AWS documentation: http://docs.aws.amazon.com/sdkforruby/api/Aws/S3/Presigner.html