Securing S3 bucket for users?

user_10749925 0
Viewed 700

I have developed a react native app, with AWS Amplify to support the backend (DynamoDB, S3). All users of the app have to use Auth.signIn() to sign in and are part of a user pool.

Once in, they can start to upload videos to S3 via the app or view videos in the app that are in the S3 bucket that is PUBLIC.

I use the path to the S3 video (https://myS3bucket....) as the source URL of the video. However the videos are only visible in my app when the bucket is public. Any other setting (protected/private) and no video is visible. How can i make this more secure?

aws-amplify react-native reactjs amazon-web-services amazon-s3
3 Answers

S3 Buckets have 3 methods of managing security:

  • IAM: Any user or role within the same AWS account as the bucket can be granted permissions to interact with the S3 Bucket and its objects.
  • S3 Bucket Policies: Grant bucket wide (or prefix) access to S3 buckets.
  • S3 ACLs - Per object level permissions.

Its generally advised against using S3 ACLs these days as their functionality was improved via S3 bucket policies. Only use them if you need a specific object to have a different set of permissions.

user_134609330

I sugeest not to make files or the bucket public if you want authenticated users to upload and/or download files. For this, use S3 signed URLs to give users access to files. In other words, the backend will authenticate users accordingly, generate them signed URLs and then the react native app will interpret that URL accordingly, ie a video file.

You will need to change a few things but this guide should cover that

user_22657580

I have recently published an article which describes in detail the security best practices, which help address the following points:

  • How to secure an S3 buckets, which store sensitive user data and the application code.
  • How to securely configure a CloudFront distribution.
  • How to protect frontend apps against common OWASP threats with CloudFront Functions.

To learn more have a look at the article.

Best, Stefan

user_50320920
Related