Is there a way to allow GetObjectAttributes but not GetObject in AWS S3?

Sirawit 'Plum' P. 0
Viewed 17

My project allow users to write their own content. Each person's content is private, and should not be allowed to seen by others. However, there is a polling logic from client side where I use AWS S3 SDK (Web JavaScript) to wait for object (file in S3) to exist. The point is, I want the information "Whether this object exists or not?" to be public but "What exactly is this object's data?" to be private. However, by allowing the GetObjectAttributes permission alone this doesn't allow the HeadObject function to work. So to allow fetching from client side I must also enable GetObject which contradicts my goal. So is there a way to implement this?

Nevertheless, if there is no good way of doing this I'm planning to create another lambda function to do the HeadObject with admin access and basic client authorization. The drawbacks are: it is more complicated, it is (logically, presumably) more time-consuming due to overhead of the lambda and it would be more expensive (even though it's just a "hobby" scale, but this would amount to an extra factor).

The current solution in my mind is to (painfully) allow GetObject but with the key (filename) appended with crypto-random-string. (which is still not an acceptable way for me).

Any solution to this case would be appreciated.

amazon-iam amazon-s3 amazon-web-services
1 Answers

You could use the listObjects api to see if an object exists in the bucket.

See : https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListObjectsV2.html

Returns some or all (up to 1,000) of the objects in a bucket with each request. You can use the request parameters as selection criteria to return a subset of the objects in a bucket. A 200 OK response can contain valid or invalid XML. Make sure to design your application to parse the contents of the response and handle it appropriately. Objects are returned sorted in an ascending order of the respective key names in the list. For more information about listing objects, see Listing object keys programmatically

To use this operation, you must have READ access to the bucket.

To use this action in an AWS Identity and Access Management (IAM) policy, you must have permissions to perform the s3:ListBucket action. The bucket owner has this permission by default and can grant this permission to others. For more information about permissions, see Permissions Related to Bucket Subresource Operations and Managing Access Permissions to Your Amazon S3 Resources.

So they could see the list of objects in the bucket but not the actual objects.

Also note that from a code perspective you could use the prefix parameter of the API to filter only things that your user has uploaded. Assuming, ofcourse that there is a pattern to prefixes/paths based on the user.

Hope this helps!

Yogesh_D0
Related