How to automate visualization of S3 objects by using Lambda? - amazon-web-services

The thing is that I have these objects in my S3 bucket (email) and I want to be able to visualize them since they're not that easy to open them and if you want to you need to manually do it. I was told there was a way to use Lambda function with S3 to be able to create a some kind of html view page to see the objects.
Hope someone can help me do that.

Based on what you have provided, Here's what I understand.
You've email(s) in S3
You want to visualize/read them via website
There are many ways to do it. Simplest of all is using s3's public hosting capability. See this AWS doc for step by step details.
This example assumes your email is in .txt format. If you have any other formt (e.g. pdf / eml etc) you will need corresponding parser library and logic to open and read those. In that case this example may not work. you may want to look at other aws options such as aws lightsail or aws amplify, It will depend on your requirements.
Based on AWS doc, Here's what you can do at a high-level.
Create a basic index.html and upload to s3 folder.
Create a basic error.html and upload to your s3 folder.
Under bucket URL -> properties edit and enable 'Static Website Hosting'
e.g. https://s3.console.aws.amazon.com/s3/buckets/yours3bucket?region=us-west-1&tab=properties
This will give you an website URL something like below.
http://yours3bucket.s3-website-us-west-1.amazonaws.com
Under bucket URL -> permissions , UnCheck "Block all public access".
[ caution: this will open your s3 bucket to the world. For better access control, consider using IAM ]
Add a bucket policy.
[This example shows policy to enable access to anyone. you should consider restricting to certain users using IAM]
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "PublicRead",
"Effect": "Allow",
"Principal": "*",
"Action": [
"s3:GetObject",
"s3:GetObjectVersion"
],
"Resource": "arn:aws:s3:::yours3bucket/*"
}
]
}
After that, simply launch your static website
http://yours3bucket.s3-website-us-west-1.amazonaws.com/index.html
Each of your email (assuming its in text format) should be accessible as below.
http://yours3bucket.s3-website-us-west-1.amazonaws.com/youremailobject.txt
Here's how it looks at my end

Related

Make every object in an Amazon S3 bucket publicly accessible

I have a S3 bucket on AWS to which I am uploading images from the frontend.
After successfully uploading an image to S3, this is the URL I get -
https://cewa-foundation-2020.s3.amazonaws.com/image8_%281%29.webp-1628768330444.webp
I want to make this URL public so that anyone with this link can view the image.
How can I achieve this?
To make every object public you should add a Bucket Policy to the bucket.
Go to the bucket's Permissions tab
Go to the Block public access options
Turn off the two options that mention Bucket Policies:
Below that, add a Bucket Policy that grants access to anonymous users:
{
"Version":"2012-10-17",
"Statement":[
{
"Sid": "PublicRead",
"Effect": "Allow",
"Principal": "*",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::YOUR-BUCKET-NAME/*"
}
]
}
All objects in the bucket can now be accessed by anyone on the Internet. However, they will not be able to list the contents of the bucket, so they will need to know the exact name of the object they want to access.
You can make an object public by doing these below steps:
Open the object by choosing the link on the object name.
Choose the Permissions tab.
Choose Edit.
In the Everyone section, select Objects Read.
Select I understand the effects of these changes on this object.
Choose Save changes.
This is just one of the ways of doing it. Check the below link for more such ways.
Source: https://aws.amazon.com/premiumsupport/knowledge-center/read-access-objects-s3-bucket/

How to stop people from downloading my Amazon S3 video files

I have created a educational website where i'am providing video lectures.
i'am using Amazon S3 bucket for storing/hosting video.
and using the link i'am showing that video to my website but...
That Video has the download button at bottom...
and any one can download the full video
i want to prevent it from downloading
i'am just frustrated
tried changing bucket policies
tried changing ACL's but nothing is working may be i'am wrong
and also tried the aws pre-signed urls but that also has a download button.
please please please..... help me
One option is to have your back-end generate an Amazon S3 pre-signed URL, which is a time-limited URL that provides temporary access to a private object. Your app would first authenticate the user, then generate the pre-signed URL. It will continue to work for a given period of time. After that time, the link no longer works. However, during that time they could download the file.
Another option is to use a streaming server (eg Wowza or Elemental) that sends content that can't be downloaded. However, extra costs are involved to run such a service.
Unfortunately, it is the nature of the Internet that you need to send content to users, and users can either consume or download that content. Some people would say that this is a benefit of the Internet!
first find the bucket where you keep your files >> go to properties and edit
Default encryption
Enabled
Server-side encryption
Amazon S3-managed keys (SSE-S3)
then save next go to >> permissions and edit the bucket policy
add the condition below: StringLike and Referer
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "PublicRead",
"Effect": "Allow",
"Principal": "",
"Action": [
"s3:GetObject"
],
"Resource": "arn:aws:s3:::YOUR-BUCKET-NAME/",
"Condition": {
"StringLike": {
"aws:Referer": "https: //YOURWEBSITE/*"
}
}
}
]
}
then save
i tested it in my website. it works. it also works in images but it will not affect your pdf documents
if you have any pdf files

Restrict read-write access from my S3 bucket

I am hosting a website where users can write and read files, which are stored into another S3 Bucket. However, I want to restrict the access of these files only to my website.
For example, loading a picture.
If the request comes from my website (example.com), I want the read (or write if I upload a picture) request to be allowed by the AWS S3 storing bucket.
If the request comes from the user who directly writes the Object URL in his browser, I want the storing bucket to block it.
Right now, even with all I have tried, people can access ressources from the Object URL.
Here is my Bucket Policy:
{
"Version": "2012-10-17",
"Id": "Id",
"Statement": [
{
"Sid": "Sid",
"Effect": "Allow",
"Principal": "*",
"Action": [
"s3:PutObject",
"s3:GetObject",
"s3:GetObjectAcl"
],
"Resource": "arn:aws:s3:::storage-bucket/*",
"Condition": {
"StringLike": {
"aws:Referer": "http://example.com/*"
}
}
}
]
}
Additionnal informations:
All my "Block public access" are unchecked as you can see here. (I think that the problem comes from here. When I check the two boxes about ACL, my main problem is fixed, but I got a 403 error - Forbidden - when it comes to upload files to the Bucket, another problem);
My ACL looks like this;
My website is statically hosted on another S3 Bucket.
If you need more informations or details, ask me.
Thank you in advance for your answers.
This message has been written by a French speaking guy. Sorry for the mistakes
"aws:Referer": "http://example.com/*
The referer is an http header passed by the browser and any client could just freely set the value. It provides no real security
However, I want to restrict the access of these files only to my website
Default way restrict access to S3 resources for a website is using the pre-signed url. Basically your website backend can create an S3 url to download or upload an s3 object and pass the url only to authenticated /allowed client. Then your resource bucket can restrict the public access. Allowing upload without authentication is usually a very bad idea.
Yes, in this case your website is not static anymore and you need some backend logic to do so.
If your website clients are authenticated, you may use the AWS API Gateway and Lambda to create this pre-signed url for the clients.

How to create correct S3 bucket policy to enable read access to a file only if they know the path

My web app allows different user to upload different files. Currently putting them all in one bucket, something like:
A12345-Something.zip
B67890-Lorem.zip
A12345-... is file uploaded by user id A12345.
B67890-... is file uploaded by user id B67890.
This is my S3 bucket policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "PublicRead",
"Effect": "Allow",
"Principal": "*",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::xxxx/*"
}
]
}
So far, this is all good, user A12345 can download the zip file by accessing https://xxxx.s3.ap-south-1.amazonaws.com/A12345-Something.zip
But the AWS interface gives me a warning that this bucket is a public bucket and it is highly recommended to not set it to public.
I am not sure but it is indeed very wrong if the policy above allows someone to list all objects from all users in my bucket and then access them one by one.
I think I need a policy that only allows reading a specific object if the full path is provided (assuming only that user will have access to that full path), but disallow listing of objects?
How should the policy looks like?
The policy you've specified allows someone to get all objects which means if they have the path they can retrieve that file publicly in the browser.
The permission ListObjects would be the permission that allows people to list all of the objects in your S3 bucket, this is not included.
If only specific users should be accessing this content, you should take a look at using signed URLs instead, this would prevent someone guessing or somehow gaining access to a link you do not want them to have.
This warning is in place to protect sensitive data being left exposed to the world, which is recent times has caused large volumes of private company data to be leaked.

Can't download objects from S3 using the URL link

I have a policy like below which I've attached to several users:
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"s3:*"
],
"Effect": "Allow",
"Resource": [
"arn:aws:s3:::foo-bar",
"arn:aws:s3:::foo-bar/*"
]
}
]
}
The intent of this policy is that these users would have full control over the bucket foo-bar. However, I'm noticing that even though the users can download the objects in these buckets using Accesskey and Secretkey. They can not download the objects via a URL e.g. https://s3.amazonaws.com/foo-bar/test.docx
I am currently logged in as a IAMManager user and also have AmazonS3FullAccess. I can see the list of objects in this bucket but when I click the URL I can't download them. I can, however, download them via clicking the Download button.
Question
Is there anything I need to change in my policy OR the objects can only be downloaded via the URL when they are publicly available?
By using your IAM policy on your users, you are granting S3 API access to the bucket for those users only. However, when accessing the bucket via the URL, you are not using the S3 APIs and no authentication information is being sent.
In order to download objects from an S3 bucket directly via the URL, the bucket needs to be made public, which you may or may not want to do.