How to securely use Amazon S3 in a messaging application

Question

So I'm building a messaging app in Cordova and I was wondering what the best approach is to secure the image files so no one else can view them. I suppose I can just generate random filenames and store them in the database, but that feels like pseudo-security. I also know that you can createPresignedRequest() , but that's for temporary files I believe. Maybe I'm missing something, but I can't figure out a good way to do this. I'm also using the PHP SDK. Not too important for scenario, but figured I'd mention it.

Answer 1

I also know that you can createPresignedRequest(), but that's for temporary files I believe.

Pre-signed links are temporary, but it doesn't matter if the object in S3 is.

You can either use pre-signed URLs or Amazon Cognito in combination with AWS IAM roles to grant certain users access to the files.

How it would work with Cognito is described on the following page: https://docs.aws.amazon.com/cognito/latest/developerguide/iam-roles.html