-
Notifications
You must be signed in to change notification settings - Fork 273
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Access without making Bucket public #11
Comments
@vaulstein can you explain a bit more the use case you have in mind? |
In case one does not want to make a bucket public, but wants to view the
contents or provide a restricted access to certain users.
For example, I was trying to deploy the index.html on an elasticbeanstalk
environment. I can control access to the elasticbeanstalk app url. But
without the contents being public I cannot view the contents of the s3
bucket.
The AWS Javascript sdk also does seem to help with such a deployment.
Is there a way to access the s3 bucket contents with such a configuration?
Having a node clone of this and using the node AWS sdk?
…On Tue 6 Mar, 2018, 7:43 PM Joe Flasher, ***@***.***> wrote:
@vaulstein <https://github.com/vaulstein> can you explain a bit more the
use case you have in mind?
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
<#11 (comment)>,
or mute the thread
<https://github.com/notifications/unsubscribe-auth/AGY2J3RJDJc217zOQksjJG3Vg0qWwGwVks5tbplxgaJpZM4SeiGd>
.
|
@jflasher I tried using Cognito to achieve the above requirement as done on this link - Cognito for S3 Access, but I still receive a Forbidden response. |
Hi, we're looking at some options to provide a variant that includes authentication using AWS credentials. |
That would be so great! Thanks.
…On Fri 9 Mar, 2018, 8:42 PM john, ***@***.***> wrote:
Hi, we're looking at some options to provide a variant that includes
authentication using AWS credentials.
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
<#11 (comment)>,
or mute the thread
<https://github.com/notifications/unsubscribe-auth/AGY2J5sw3HcJboZWffVT_VPFXbKvTkzwks5tcpvdgaJpZM4SeiGd>
.
|
While not a complete solution, a short-term workaround for this request might be to make the bucket public but restrict access to whitelisted IPs, as follows in an S3 bucket policy:
|
I would still like to see a version that uses makeRequest instead of makeUnauthenticatedRequest if possible, to use non-public buckets. I'm hoping to use the Condition operator for a StringLike argument to restrict access to a specific subfolder within a bucket. It doesn't look like it's possible to combine two different condition operators, so I can't use IpAddress and StringLike together. If that's something you can add or help me implement, I'd really appreciate it! |
@geomapdev Apologies for the late response. Could you implement what you need as follows?
Without modifications to the code, the user would still see the breadcrumb for the top-level folder and could click it but the user would not be able to navigate to it and instead would see Access Denied. This could potentially be extended to multiple unauthenticated users accessing different folders in the same bucket if you can differentiate them by source IP. Anyhow, hope this gives you some ideas. |
@vaulstein Hi, I have uploaded an alpha of version 2 of S3 Explorer that can be used with private S3 buckets. This version is optimized for private buckets, so always asks you for bucket name and credentials when loading, but it can also be used for public S3 buckets. You can host this tool in any S3 bucket you like and use it to explore any other bucket(s) (assuming that you have appropriate CORS settings on the chosen target bucket and your IAM credentials have sufficient S3 permissions). Note some of the key features of this v2 alpha:
If you choose to explore a private S3 bucket then you will need to supply AWS credentials. Credentials can be provided in one of the following forms:
|
@geomapdev Please note availability of an alpha of version 2 of S3 Explorer, supporting authentication for private S3 buckets. |
Hi, John |
@Pongchaiwat Correct, you'll need all 3 files (HTML, CSS, and JS) in the same S3 bucket (they should all be publicly readable, but you can also configure an IP whitelist in your S3 bucket policy if desired). Note that you could choose to create a single HTML that contained all 3 files inline if you wanted for ease of distribution, but we chose to separate them for v2 because the file sizes were getting large. |
@Pongchaiwat Please ensure that your target S3 bucket (test-test-0001) has the correct CORS configuration, especially the AllowedOrigin. You have a few options when it comes to AllowedOrigin.
<AllowedOrigin>https://bucket1.s3.amazonaws.com</AllowedOrigin>
<AllowedOrigin>https://s3.amazonaws.com</AllowedOrigin>
<AllowedOrigin>*</AllowedOrigin> |
@Pongchaiwat I've created #27 to track this issue with signature v4 regions. |
Is there a way to use the index.html without making the bucket public?
The text was updated successfully, but these errors were encountered: