Read S3 object from S3 bucket by signed url from CloudFront










0















How to Read S3 object from S3 bucket by signed url from CloudFront.



  1. I have S3 Bucket and have some files i.e. S3 Object.

  2. S3 object are not public.


  3. I create S3 Signed url by boto3 which available for 3600 seconds. It is working fine. After 3600 seconds singed url is invalid which is correct.



    S3 Signed URL: https://s3.amazonaws.com/BucketName/2018-11-01_19_43_31.pdf?AWSAccessKeyId=XXXXX&Signature=XXXXXX&x-amz-security-token=xxxxxx&Expires=XXXXX




  4. I created CloudFront Distribution with Origin Settings to S3 bucket.



    CloudFront endpoint: https://qwqwqwqwqw.cloudfront.net/




  5. I create signed url (step 3) and replace with end-point of CloudFront Distribution.



    https://qwqwqwqwqw.cloudfront.net/2018-11-01_19_43_31.pdf?AWSAccessKeyId=XXXXX&Signature=XXXXXX&x-amz-security-token=xxxxxx&Expires=XXXXX



I able to download S3 object. But after 3600 seconds also I able
to download file. Test case is - do not download S3 object.



Following is my bucket policy:




"Version": "2008-10-17",
"Statement": [

"Effect": "Allow",
"Principal":
"AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity $SDSDSFDAs$"
,
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::my-bucket-name/*"

]










share|improve this question
























  • What did you actually do in step 5? The procedure for creating CloudFront signed URLs is documented at docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/…

    – jarmod
    Nov 13 '18 at 15:50











  • I am creating S3 pre-signed url and only adding cloudfront endpoint. Updated question

    – Vivek Sable
    Nov 14 '18 at 10:33











  • That’s not, to the best of my knowledge, a viable procedure for creating a CloudFront signed URL. Please read the document I referenced earlier.

    – jarmod
    Nov 14 '18 at 12:28















0















How to Read S3 object from S3 bucket by signed url from CloudFront.



  1. I have S3 Bucket and have some files i.e. S3 Object.

  2. S3 object are not public.


  3. I create S3 Signed url by boto3 which available for 3600 seconds. It is working fine. After 3600 seconds singed url is invalid which is correct.



    S3 Signed URL: https://s3.amazonaws.com/BucketName/2018-11-01_19_43_31.pdf?AWSAccessKeyId=XXXXX&Signature=XXXXXX&x-amz-security-token=xxxxxx&Expires=XXXXX




  4. I created CloudFront Distribution with Origin Settings to S3 bucket.



    CloudFront endpoint: https://qwqwqwqwqw.cloudfront.net/




  5. I create signed url (step 3) and replace with end-point of CloudFront Distribution.



    https://qwqwqwqwqw.cloudfront.net/2018-11-01_19_43_31.pdf?AWSAccessKeyId=XXXXX&Signature=XXXXXX&x-amz-security-token=xxxxxx&Expires=XXXXX



I able to download S3 object. But after 3600 seconds also I able
to download file. Test case is - do not download S3 object.



Following is my bucket policy:




"Version": "2008-10-17",
"Statement": [

"Effect": "Allow",
"Principal":
"AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity $SDSDSFDAs$"
,
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::my-bucket-name/*"

]










share|improve this question
























  • What did you actually do in step 5? The procedure for creating CloudFront signed URLs is documented at docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/…

    – jarmod
    Nov 13 '18 at 15:50











  • I am creating S3 pre-signed url and only adding cloudfront endpoint. Updated question

    – Vivek Sable
    Nov 14 '18 at 10:33











  • That’s not, to the best of my knowledge, a viable procedure for creating a CloudFront signed URL. Please read the document I referenced earlier.

    – jarmod
    Nov 14 '18 at 12:28













0












0








0








How to Read S3 object from S3 bucket by signed url from CloudFront.



  1. I have S3 Bucket and have some files i.e. S3 Object.

  2. S3 object are not public.


  3. I create S3 Signed url by boto3 which available for 3600 seconds. It is working fine. After 3600 seconds singed url is invalid which is correct.



    S3 Signed URL: https://s3.amazonaws.com/BucketName/2018-11-01_19_43_31.pdf?AWSAccessKeyId=XXXXX&Signature=XXXXXX&x-amz-security-token=xxxxxx&Expires=XXXXX




  4. I created CloudFront Distribution with Origin Settings to S3 bucket.



    CloudFront endpoint: https://qwqwqwqwqw.cloudfront.net/




  5. I create signed url (step 3) and replace with end-point of CloudFront Distribution.



    https://qwqwqwqwqw.cloudfront.net/2018-11-01_19_43_31.pdf?AWSAccessKeyId=XXXXX&Signature=XXXXXX&x-amz-security-token=xxxxxx&Expires=XXXXX



I able to download S3 object. But after 3600 seconds also I able
to download file. Test case is - do not download S3 object.



Following is my bucket policy:




"Version": "2008-10-17",
"Statement": [

"Effect": "Allow",
"Principal":
"AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity $SDSDSFDAs$"
,
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::my-bucket-name/*"

]










share|improve this question
















How to Read S3 object from S3 bucket by signed url from CloudFront.



  1. I have S3 Bucket and have some files i.e. S3 Object.

  2. S3 object are not public.


  3. I create S3 Signed url by boto3 which available for 3600 seconds. It is working fine. After 3600 seconds singed url is invalid which is correct.



    S3 Signed URL: https://s3.amazonaws.com/BucketName/2018-11-01_19_43_31.pdf?AWSAccessKeyId=XXXXX&Signature=XXXXXX&x-amz-security-token=xxxxxx&Expires=XXXXX




  4. I created CloudFront Distribution with Origin Settings to S3 bucket.



    CloudFront endpoint: https://qwqwqwqwqw.cloudfront.net/




  5. I create signed url (step 3) and replace with end-point of CloudFront Distribution.



    https://qwqwqwqwqw.cloudfront.net/2018-11-01_19_43_31.pdf?AWSAccessKeyId=XXXXX&Signature=XXXXXX&x-amz-security-token=xxxxxx&Expires=XXXXX



I able to download S3 object. But after 3600 seconds also I able
to download file. Test case is - do not download S3 object.



Following is my bucket policy:




"Version": "2008-10-17",
"Statement": [

"Effect": "Allow",
"Principal":
"AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity $SDSDSFDAs$"
,
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::my-bucket-name/*"

]







amazon-web-services amazon-s3 aws-cloudfront






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited Nov 14 '18 at 10:40







Vivek Sable

















asked Nov 13 '18 at 11:21









Vivek SableVivek Sable

5,96011832




5,96011832












  • What did you actually do in step 5? The procedure for creating CloudFront signed URLs is documented at docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/…

    – jarmod
    Nov 13 '18 at 15:50











  • I am creating S3 pre-signed url and only adding cloudfront endpoint. Updated question

    – Vivek Sable
    Nov 14 '18 at 10:33











  • That’s not, to the best of my knowledge, a viable procedure for creating a CloudFront signed URL. Please read the document I referenced earlier.

    – jarmod
    Nov 14 '18 at 12:28

















  • What did you actually do in step 5? The procedure for creating CloudFront signed URLs is documented at docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/…

    – jarmod
    Nov 13 '18 at 15:50











  • I am creating S3 pre-signed url and only adding cloudfront endpoint. Updated question

    – Vivek Sable
    Nov 14 '18 at 10:33











  • That’s not, to the best of my knowledge, a viable procedure for creating a CloudFront signed URL. Please read the document I referenced earlier.

    – jarmod
    Nov 14 '18 at 12:28
















What did you actually do in step 5? The procedure for creating CloudFront signed URLs is documented at docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/…

– jarmod
Nov 13 '18 at 15:50





What did you actually do in step 5? The procedure for creating CloudFront signed URLs is documented at docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/…

– jarmod
Nov 13 '18 at 15:50













I am creating S3 pre-signed url and only adding cloudfront endpoint. Updated question

– Vivek Sable
Nov 14 '18 at 10:33





I am creating S3 pre-signed url and only adding cloudfront endpoint. Updated question

– Vivek Sable
Nov 14 '18 at 10:33













That’s not, to the best of my knowledge, a viable procedure for creating a CloudFront signed URL. Please read the document I referenced earlier.

– jarmod
Nov 14 '18 at 12:28





That’s not, to the best of my knowledge, a viable procedure for creating a CloudFront signed URL. Please read the document I referenced earlier.

– jarmod
Nov 14 '18 at 12:28












0






active

oldest

votes











Your Answer






StackExchange.ifUsing("editor", function ()
StackExchange.using("externalEditor", function ()
StackExchange.using("snippets", function ()
StackExchange.snippets.init();
);
);
, "code-snippets");

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "1"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);



);













draft saved

draft discarded


















StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53279927%2fread-s3-object-from-s3-bucket-by-signed-url-from-cloudfront%23new-answer', 'question_page');

);

Post as a guest















Required, but never shown

























0






active

oldest

votes








0






active

oldest

votes









active

oldest

votes






active

oldest

votes















draft saved

draft discarded
















































Thanks for contributing an answer to Stack Overflow!


  • Please be sure to answer the question. Provide details and share your research!

But avoid


  • Asking for help, clarification, or responding to other answers.

  • Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.




draft saved


draft discarded














StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53279927%2fread-s3-object-from-s3-bucket-by-signed-url-from-cloudfront%23new-answer', 'question_page');

);

Post as a guest















Required, but never shown





















































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown

































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown







Popular posts from this blog

Top Tejano songwriter Luis Silva dead of heart attack at 64

政党

天津地下鉄3号線