AWS AmazonS3 documentation change
Summary
Added detailed Python code example for generating PUT presigned URLs, updated expiration time guidance, and removed outdated Visual Studio Mac reference
Security assessment
Adds documentation about security feature (presigned URLs) but does not address a specific security vulnerability. The changes improve documentation for a security-related feature (temporary access credentials) without indicating any security incident.
Diff
diff --git a/AmazonS3/latest/userguide/PresignedUrlUploadObject.md b/AmazonS3/latest/userguide/PresignedUrlUploadObject.md index 9d7aaa48e..9eba0937f 100644 --- a/AmazonS3/latest/userguide/PresignedUrlUploadObject.md +++ b/AmazonS3/latest/userguide/PresignedUrlUploadObject.md @@ -17 +17 @@ You can create a presigned URL for uploading an object without writing any code -At this time, the AWS Toolkit for Visual Studio does not support Visual Studio for Mac. +At this time, the AWS Toolkit for Visual Studio doesn't support Visual Studio for Mac. @@ -44,3 +44 @@ At this time, the AWS Toolkit for Visual Studio does not support Visual Studio f -For examples of using the AWS SDKs to generate a presigned URL for uploading an object, see [Create a presigned URL for Amazon S3 by using an AWS SDK](https://docs.aws.amazon.com/AmazonS3/latest/API/s3_example_s3_Scenario_PresignedUrl_section.html). - -When you use the AWS SDKs to generate a presigned URL, the maximum expiration time is 7 days from the time of creation. +You can generate a presigned URL that can perform an S3 action for a limited time. @@ -50 +48,75 @@ When you use the AWS SDKs to generate a presigned URL, the maximum expiration ti -For all AWS Regions launched after March 20, 2019 you need to specify the `endpoint-url` and `AWS Region` with the request. For a list of all the Amazon S3 Regions and endpoints, see [Regions and Endpoints](https://docs.aws.amazon.com/general/latest/gr/rande.html#s3_region) in the _AWS General Reference_. +If you use the AWS CLI or AWS SDKs, the expiration time for presigned URLs can be set as high as 7 days. For more information, see [Expiration time for presigned URLs](https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-presigned-url.html#PresignedUrl-Expiration). + +Python + + +The following Python script generates a `PUT` presigned URL for uploading an object to an S3 general purpose bucket. + + 1. Copy the contents of the script and save it as “`put-only-url.py`” file. To use the following examples, replace the `user input placeholders` with your own information (such as your file name). + + import argparse + import boto3 + from botocore.exceptions import ClientError + + def generate_presigned_url(s3_client, client_method, method_parameters, expires_in): + """ + Generate a presigned Amazon S3 URL that can be used to perform an action. + + :param s3_client: A Boto3 Amazon S3 client. + :param client_method: The name of the client method that the URL performs. + :param method_parameters: The parameters of the specified client method. + :param expires_in: The number of seconds the presigned URL is valid for. + :return: The presigned URL. + """ + try: + url = s3_client.generate_presigned_url( + ClientMethod=client_method, + Params=method_parameters, + ExpiresIn=expires_in + ) + except ClientError: + print(f"Couldn't get a presigned URL for client method '{client_method}'.") + raise + return url + + def main(): + parser = argparse.ArgumentParser() + parser.add_argument("bucket", help="The name of the bucket.") + parser.add_argument( + "key", help="The key (path and filename) in the S3 bucket.", + ) + args = parser.parse_args() + + # By default, this will use credentials from ~/.aws/credentials + s3_client = boto3.client("s3") + + # The presigned URL is specified to expire in 1000 seconds + url = generate_presigned_url( + s3_client, + "put_object", + {"Bucket": args.bucket, "Key": args.key}, + 1000 + ) + print(f"Generated PUT presigned URL: {url}") + + if __name__ == "__main__": + main() + + 2. To generate a `PUT` presigned URL for uploading a file, run the following script with your bucket name and desired object path. + +The following command uses example values. Replace the `user input placeholders` with your own information. + + python put-only-url.py amzn-s3-demo-bucket <object-path> + +The script will output a `PUT` presigned URL: + + Generated PUT presigned URL: https://amzn-s3-demo-bucket.s3.amazonaws.com/object.txt?AWSAccessKeyId=AKIAIOSFODNN7EXAMPLE&Signature=vjbyNxybdZaMmLa%2ByT372YEAiv4%3D&Expires=1741978496 + + 3. You can now upload the file using the generated presigned URL with curl: + + curl -X PUT -T "path/to/your/local/file" "generated-presigned-url" + + + + +For more examples of using the AWS SDKs to generate a presigned URL for uploading an object, see [Create a presigned URL for Amazon S3 by using an AWS SDK](https://docs.aws.amazon.com/AmazonS3/latest/API/s3_example_s3_Scenario_PresignedUrl_section.html).