AWS generate dynamic credential for S3 folder level access?

问题

I'm new to AWS and still figuring out how to do things.

Part of my web application is using AWS S3 for file storage, but I want each user to be only able to access specific folders(for CRUD) in the bucket. The backend server will track what folders the user will be able to access.

I know it is possible to define policies that allow access to specific folders(by matching prefix of objects), but can I generate these policies dynamically and get credentials with these policies attached (probably with Cognito?). So that these credentials could be passed to client-side to enable access to S3 folders.

I'm wondering if it is possible to do that and what services are required to achieve this.

回答1:

You should change your view, each time you want to share a file with one of your users, you should check your database about their permissions( folders they have access) and if logical things on your side are correct, generate a presigned URL for access to that object.

How presigned URL works.

When you generate a presigned URL for accessing to an object, you can set the time limit too, it means after that time, the URL not work and expired.

For more information about the presigned URL, read the following documents on Amazon Web services website:

Generate a Pre-signed Object URL Using the AWS SDK for Java

Generate a Pre-signed Object URL Using AWS SDK for .NET

Also, if you want to create users and assign the right policy for access them to their folder you can follow these instructions:

You can use the IAM API to creating a user for each of your users, and attach the right policy for each of them. For example, for creating the new user, you should use the following API

/* The following create-user command creates an IAM user named Bob in the current account. */

 var params = {
  UserName: "Bob"
 };
 iam.createUser(params, function(err, data) {
   if (err) console.log(err, err.stack); // an error occurred
   else     console.log(data);           // successful response
   /*
   data = {
    User: {
     Arn: "arn:aws:iam::123456789012:user/Bob", 
     CreateDate: <Date Representation>, 
     Path: "/", 
     UserId: "AKIAIOSFODNN7EXAMPLE", 
     UserName: "Bob"
    }
   }
   */
 });

For more info about the Create user API, read the following

https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateUser.html

After creating a user, you should create a policy for each of them with CreatePolicy API.

var params = {
  PolicyDocument: 'STRING_VALUE', /* required */
  PolicyName: 'STRING_VALUE', /* required */
  Description: 'STRING_VALUE',
  Path: 'STRING_VALUE'
};
iam.createPolicy(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

For more info about the Create policy read the following doc:

https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreatePolicy.html

And finally, you should assign the policy you created before to each user by the AttachUserPolicy API.

/* The following command attaches the AWS managed policy named AdministratorAccess to the IAM user named Alice. */

     var params = {
      PolicyArn: "arn:aws:iam::aws:policy/AdministratorAccess", 
      UserName: "Alice"
     };
     iam.attachUserPolicy(params, function(err, data) {
       if (err) console.log(err, err.stack); // an error occurred
       else     console.log(data);           // successful response
     });

For more info about the AttachUserPolicy API read the following doc:

https://docs.aws.amazon.com/IAM/latest/APIReference/API_AttachUserPolicy.html

The last part is about the which policy you should create and assign to each of them; we use the following policy for listing objects in each folder:

{
  "Sid": "AllowListingOfUserFolder",
  "Action": ["s3:ListBucket"],
  "Effect": "Allow",
  "Resource": ["arn:aws:s3:::my-company"],
  "Condition":{"StringLike":{"s3:prefix":["home/David/*"]}}
}

And the following policy for actions in each folder:

{
  "Sid": "AllowAllS3ActionsInUserFolder",
  "Effect": "Allow",
  "Action": ["s3:*"],
  "Resource": ["arn:aws:s3:::my-company/home/David/*"]
}

For more detailed info about that policies read the following article by Jim Scharf:

https://aws.amazon.com/blogs/security/writing-iam-policies-grant-access-to-user-specific-folders-in-an-amazon-s3-bucket/

来源：https://stackoverflow.com/questions/52687127/aws-generate-dynamic-credential-for-s3-folder-level-access