AWS AmazonS3 documentation change
Summary
Updated console navigation steps from 'Buckets' to 'General purpose buckets' and added detailed Python code example for generating presigned URLs with expiration time
Security assessment
The change adds explicit code examples for generating presigned URLs with expiration (1000 seconds), promoting security best practices for temporary access. However, there is no evidence of addressing a specific security vulnerability.
Diff
diff --git a/AmazonS3/latest/userguide/ShareObjectPreSignedURL.md b/AmazonS3/latest/userguide/ShareObjectPreSignedURL.md index 65882100a..05e698ac4 100644 --- a//AmazonS3/latest/userguide/ShareObjectPreSignedURL.md +++ b//AmazonS3/latest/userguide/ShareObjectPreSignedURL.md @@ -19 +19 @@ You can use the Amazon S3 console to generate a presigned URL for sharing an obj - 2. In the left navigation pane, choose **Buckets**. + 2. In the left navigation pane, choose **General purpose buckets**. @@ -21 +21 @@ You can use the Amazon S3 console to generate a presigned URL for sharing an obj - 3. In the **Buckets** list, choose the name of the bucket that contains the object that you want a presigned URL for. + 3. In the **General purpose buckets** list, choose the name of the general purpose bucket that contains the object that you want a presigned URL for. @@ -50 +50 @@ For more information, see [presign](https://awscli.amazonaws.com/v2/documentatio -For examples of using the AWS SDKs to generate a presigned URL for sharing an object, see [Create a presigned URL for Amazon S3 by using an AWS SDK](https://docs.aws.amazon.com/AmazonS3/latest/API/s3_example_s3_Scenario_PresignedUrl_section.html). +You can generate a presigned URL programmatically by using the AWS SDKs. @@ -52 +52,73 @@ For examples of using the AWS SDKs to generate a presigned URL for sharing an ob -When you use the AWS SDKs to generate a presigned URL, the maximum expiration time is 7 days from the time of creation. +Python + + +The following Python script generates a `GET` presigned URL for sharing an object. + + 1. Copy the contents of the script and save it as “`get-only-url.py`” file. To use the following examples, replace the `user input placeholders` with your own information (such as your file name). + + import argparse + import boto3 + from botocore.exceptions import ClientError + + def generate_presigned_url(s3_client, client_method, method_parameters, expires_in): + """ + Generate a presigned Amazon S3 URL that can be used to perform an action. + + :param s3_client: A Boto3 Amazon S3 client. + :param client_method: The name of the client method that the URL performs. + :param method_parameters: The parameters of the specified client method. + :param expires_in: The number of seconds the presigned URL is valid for. + :return: The presigned URL. + """ + try: + url = s3_client.generate_presigned_url( + ClientMethod=client_method, + Params=method_parameters, + ExpiresIn=expires_in + ) + except ClientError: + print(f"Couldn't get a presigned URL for client method '{client_method}'.") + raise + return url + + def main(): + parser = argparse.ArgumentParser() + parser.add_argument("bucket", help="The name of the bucket.") + parser.add_argument( + "key", help="The key (path and filename) in the S3 bucket.", + ) + args = parser.parse_args() + + # By default, this will use credentials from ~/.aws/credentials + s3_client = boto3.client("s3") + + # The presigned URL is specified to expire in 1000 seconds + url = generate_presigned_url( + s3_client, + "get_object", + {"Bucket": args.bucket, "Key": args.key}, + 1000 + ) + print(f"Generated GET presigned URL: {url}") + + if __name__ == "__main__": + main() + + 2. To generate a `GET` presigned URL for sharing a file, run the following script with your bucket name and desired object path. + +The following command uses example values. Replace the `user input placeholders` with your own information. + + python get-only-url.py amzn-s3-demo-bucket <object-path> + +The script will output a `GET` presigned URL: + + Generated GET presigned URL: https://amzn-s3-demo-bucket.s3.amazonaws.com/object.txt?AWSAccessKeyId=AKIAIOSFODNN7EXAMPLE&Signature=vjbyNxybdZaMmLa%2ByT372YEAiv4%3D&Expires=1741978496 + + 3. You can download the file using the generated presigned URL with curl: + + curl -X GET "generated-presigned-url" -o "path/to/save/file" + + + + +For more examples of using the AWS SDKs to generate a presigned URL for sharing an object, see [Create a presigned URL for Amazon S3 by using an AWS SDK](https://docs.aws.amazon.com/AmazonS3/latest/API/s3_example_s3_Scenario_PresignedUrl_section.html).