S3 with IAM Policy

Question

I've created a group with read-only access to S3 objects and then added a new user within that group.

I'm having trouble understanding what the url to the file will be. I have the link thus far as:

https://s3.amazonaws.com/my-bucket/

Do I need to pass in some sort of id and key to let people in that group get access? What are those params and where I do I find the values?

Answer 1

To let people access your files you either need to make the bucket public and then access the URL's of each object which you can find out by checking the properties of each object in AWS management console. The catch is that anyone who knows this URL can access the files. To make it more secure, use ACL to limit read only access for all users. Go to permissions and add a new permission for "Everyone" and check "Open/download" check box only. if you want to limit access to only few users then you will have yo use IAM policies. With IAM policy you will get a security key and secret access key. Now, you CANNOT append the secret access key at the end of your string to give access to users. The secret user key is meant to be "SECRET".but what you can do is provide Presigned URL's to your users through code. Here is a C# example

private void GetWebUrl()
        {
            var request =
                new GetPreSignedUrlRequest().WithBucketName(your bucketName)
              .WithKey(Your obj KEY);
            request.WithExpires(DateTime.Now.Add(new TimeSpan(0, 0, 0, 50)));// Time you want URL to be active for
            var url = S3.GetPreSignedURL(request);

        }

The catch is the URL will only be active for the given time. you can increase it though. Also, in the above function "S3' is an instance of amazonS3 client that I have created:

private AmazonS3Client S3;
public static AmazonS3Client CreateS3Client()
        {

            var appConfig = ConfigurationManager.AppSettings;
            var accessKeyId = appConfig["AWSAccessKey"];
            var secretAccessKeyId = appConfig["AWSSecretKey"];
            S3= new AmazonS3Client(accessKeyId, secretAccessKeyId);
            return S3;
        }

Answer 2

Each IAM user will have their own Cert and Key that they setup with whatever S3tools they are using. Just give them the url to login to their IAM AWS accont, and their credentials to login, and they should be good to go. The bucket URL will be the same.

Answer 3

The URL to a file on S3 does not change.

Usually you would not use the form that you have but rather: https://my-bucket.s3.amazonaws.com/path/to/file.png - where path/to/file.png is the key. (see virtual hosted compatible bucket names).

The issue is that this url will result in a 404 unless the person asking for it has the right credentials, or the bucket is publicly readable.

You can take a URL like that and sign it (using a single call in some SDK) with any credentials that have read only access to the file, which will result in a time - limited URL that anyone can use. When the url is signed it has some extra args added, so that AWS can tell it was an authorized person that made up the URL.

OR

You can use the AWS API, and use the credentials that you have to directly download the file.

It depends on what you are doing.

For instance, to make a web page which has links to files, you can create a bunch of time limited URLs, one for each file. This page would be generated by some code on your server, upon a user logging in and having some sort of IAM credentials.

Or if you wanted to write a tool to manage an S3 repo, you would perhaps just download/upload, etc directly using the API.