Custom authentication with JWT for download from S3

user_8681 0
Viewed 744

I have a setup on AWS where I'm running a backend on ElasticBeanstalk/EC2, which stores some files in S3. What I'd like to do, is when an authenticated (by my backend) user wants to download a file, they can do so directly from S3, instead of going through the backend itself.

To that end, I'd like S3 to check a signed JWT before allowing a file download. For now, let's assume that any correctly signed JWT allows any file download, regardless of the JWT claims. To make this more difficult, I want the download links to be usable in HTML <img src='link/to/s3/'>, so sending the JWT in a header as you normally would isn't feasible.

Is this even possible with S3? How would I go about setting this up?

amazon-web-services amazon-s3
1 Answers

I'm not very familiar with S3, but doesn't it already have a concept of "signed URLs"?

Instead of issuing a JWT, your web app instead uses the S3 proprietary method to generate a URL which encodes the expiry time and other parameters, but the overall result is the same.

user_498490
Related