Can you limit the maximum file size that can be uploaded to the public S3 bucket?

Question

I am creating a web application that can upload files directly to a public S3 bucket using AWS for the SDK browser.

I would like to limit the maximum file size that can be downloaded, and although I can do a client-side check for file size, a clean client solution is not very reliable, and I would like to add server-side verification. Is it possible to do this using IAM roles for the "S3: PutObject" action?

Answer 1

You can limit the size of the loaded object using the content-length-range attribute in your upload form.

Here is the relevant page of the document: http://doc.s3.amazonaws.com/proposals/post.html#Limiting_Uploaded_Content

Answer 2

You can set the minimum and maximum file size in s3Policy that you create by setting up a signed downloadable URK for the direct browser to load S3.

Here is an example (JavaScript from the node.js application) - see the “reach reach length” part below:

var s3Policy = { 'expiration': expiration, 'conditions': [{ 'bucket': aws.bucket }, ['starts-with', '$key', path], { 'acl': readType }, { 'success_action_status': '201' }, ['starts-with', '$Content-Type', request.type], ['content-length-range', 2048, 124857600], //min and max ] }; 

If a user uploads a file that exceeds S3, he returns 400 bad requests with the body, including a message about exceeding the maximum file size limit.