AWS S3预签名的 URL 没有到期日期

是否有任何方法可以生成预签名的网址没有任何过期日期？ 我正在开发一个电子邮件应用程序，我的附件将保存在 S3。 也请让我知道什么是最好的方式下载附件通过 JavaScriptSDK。

我使用以下代码

var params = {Bucket: 'bucket', Key: 'key', Expires: 60};
var url = s3.getSignedUrl('getObject', params);
console.log('The URL is', url);
98891 次浏览
小开

The maximum expiration time for presigned url is one week from time of creation. So there is no way to have a presigned url without expiry time.

小开

It depends on how you generate the S3 pre-signed URL. Specifically, which signature version you use and what type of IAM credentials you use.

The credentials that you can use to create a pre-signed URL include:

  • IAM instance profile (temporary, rotated credentials): valid up to 6 hours
  • STS (temporary credentials): valid up to 36 hours
  • IAM user (long-term credentials): valid up to 7 days when using signature v4
  • IAM user (long-term credentials): valid till the end of the epoch when using signature v2

Note specifically:

  • signature v2 is potentially deprecated
  • the expiration limit for signature v2 is different to signature v4
  • signature v4 offers some security and efficiency benefits over v2
  • if you use STS credentials to generate a pre-signed URL then the URL will expire when the STS credentials expire, if that is earlier than the explicit expiration that you requested for the pre-signed URL
  • creating pre-signed URLs that are valid till the end of the epoch is not the best security practice

For more, see:

小开

A somewhat solution for you might be to make the AWS CloudFront distribution that serves your S3 bucket with limited access to only Distribution Origin Access Identity and then using CloudFront Signed urls. Which expiry time can be even in years. So for unlimited or semi-unlimited urls I would recommend such solution.

小开

On client you could do:

const image = image.split('&Expires')[0]

That's one of the workarounds that i used

小开

Not sure if you want to save the attachments indefinitely. Nonetheless, one option could be that you use an API Gateway. You will need to handle authentication and authorization yourself. You could use a token for instance that you can compare with a token in your database. The token grants access to one certain file and is part of the request URL (or it's request headers). But first on how to generate the "pre-signed URL":

  1. when an attachment is uploaded to S3 you generate a token, i.e. JWT token, with the file name.
  2. Save the token in a DynamoDB, possibly with an expiry date, if needed
  3. Return the API Gateway URL and the generated token to the user, e.g. https://get-your-attachment.io/download?token=123
  4. If the token expires use DynamoDB streams to find the file in S3 and remove it from S3 to have it cleaned up

If a user wants to download a file, they open the URL provided in step 3. The API Gateway calls an authorization Lambda. This Lambda checks that the token is still in the DynamoDB. If so, the request triggers another Lambda function which will extract the file name out of the token and return the file. You have to return the file encoded, set the response headers properly and take care of the service limits.

If the download can only be done from within your app and the link cannot be shared nor used outside of the app, then you could skip returning the file through the API Gateway. Authorization will stay as described above. But instead of returning the file, the Lambda function returns a pre-signed URL, valid for maybe 10 minutes. Your app uses the URL for another request and receives the file from S3.

As for the second part of your question on how to download the files as simple fetch(preSignedS3URL) will be enough.


提交答案