I am running some code inside a docker container, in Lambda. In the code, I use AWS CLI to generate a presigned url:
report_s3 <- paste("MY-BUCKET/stash/", cognito_user_email, cloudwatch_uuid, "/report.html", sep = "")
cmd <- paste("aws s3 presign ", report_s3, " --expires-in 604800")
presigned_url <- system(cmd, intern = TRUE)
The above code is R. And it works fine. Essentially all I'm doing here is sending the aws cli command to a bash terminal, and reading back the response.
My issue is that while the resulting presigned url works fine, it is not valid for the 7 days I requested. This is because the token used to create it expires. In order to fix this, I believe the correct approach is to :
- Use Secrets Manager to save secret access key for new IAM user with permissions. This would be done in cdk, the console, CLI... Where ever really.
- Retrieve the credentials from secret manager in the code to use IAM credentials. This wold be done with CLI.
- Create presigned URL. Again with CLI.
I have a few questions:
- How does this offer additional security over just hard coding the credentials? Since it's inside a Lambda that's only running for 300 ms.
- How would you hard code the credentials? Is it just a case of dumping a copy of the files into $HOME/.aws/credentials? And specifying --profile in the
aws s3 presign - Is it possible to do this with secrets manager etc using only CLI commands?