Amazon S3 view personal files

Question

I use Amazon S3 to upload files to different folders. All folders and files are publicly accessible and can be seen by anyone. I created a private folder where I want to place private images so that I can see them. I have already created a bucket policy rule that will restrict access to this folder. But how can I see the files? Is there a special link like this https://s3.amazonaws.com/bucket/private_folder/file.jpg?secret_key=123 that will allow me and anyone who knows this secret key to see the files?

Is there a way to upload personal files that can be seen using secret_key, url or something like that?

Answer 1

By default, all objects in Amazon S3 are private. Objects can then be made “public” by adding permissions through one of:

• Object Access Control List (ACL): Setting permission directly to the object
• Bucket Policy:. Refers to a bucket, can determine the rules related to subdirectories, key name (file names), time of day, IP address, etc.
• IAM policy: applies to specific users or groups

As long as one of these methods provides access, a person will be able to access the object. It is also possible to assign Deny permissions that override Allow permissions.

When an object is accessed through an unauthenticated URL (for example, s3.amazonaws.com/bucket-name/object-key ), the above rules determine access. However, even “private” files can be accessed if you authenticate the service, for example, calling the S3 API with user credentials or using a pre-signed URL.

To find out how this works, click the personal file in the Amazon S3 management console and select Open from the Actions menu. The object will be open. This is done by providing the browser with a pre-signed URL, which includes a cryptographic-sized URL and expiration date. The URL will work to receive a private file only until a certain time.

So, to answer your question, you can still access private files through:

• Open command in console
• Pre-Signed URLs in a Web Browser
• Authenticated API Calls

Just be careful that you don’t define DENY rules that even block your ability to access files. It’s easier to just ALLOW the directories you want to publish.

See: Query String Validation Alternative