1

How to generate the HTTPS API request(URL) signed with temporary security credentials to access AWS S3 object.I am able to access object using amazon java sdk but I would like to generate the complete url with temporary security credential like pre signed url. package com.siriusxm.repo.test;

import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStream;
import java.io.InputStreamReader;

import com.amazonaws.auth.BasicSessionCredentials;
import com.amazonaws.auth.profile.ProfileCredentialsProvider;
import com.amazonaws.regions.Region;
import com.amazonaws.services.s3.AmazonS3Client;
import com.amazonaws.services.s3.model.GetObjectRequest;
import com.amazonaws.services.s3.model.ObjectListing;
import com.amazonaws.services.securitytoken.AWSSecurityTokenServiceClient;
import com.amazonaws.services.securitytoken.model.Credentials;
import com.amazonaws.services.securitytoken.model.GetSessionTokenRequest;
import com.amazonaws.services.securitytoken.model.GetSessionTokenResult;
import com.siriusxm.repo.DownloadServiceImpl;

public class TemporaryCredential {

    private static String bucketName = "myrepo"; 
    private static String key  =  "test.pdf";

    public static void main(String[] args) {
        System.out.println("");

        AWSSecurityTokenServiceClient stsClient = new AWSSecurityTokenServiceClient(
                new ProfileCredentialsProvider());
    //  stsClient.setRegion(regionName);sts.us-west-2.amazonaws.com
        //
        // Start a session.
        GetSessionTokenRequest getSessionTokenRequest = new GetSessionTokenRequest();
        GetSessionTokenResult sessionTokenResult = stsClient
                .getSessionToken(getSessionTokenRequest);
        Credentials sessionCredentials = sessionTokenResult.getCredentials();
        System.out.println("Session Credentials: "
                + sessionCredentials.toString());
        // Package the session credentials as a BasicSessionCredentials
        // object for an S3 client object to use.
        BasicSessionCredentials basicSessionCredentials = new BasicSessionCredentials(
                sessionCredentials.getAccessKeyId(),
                sessionCredentials.getSecretAccessKey(),
                sessionCredentials.getSessionToken());

        AmazonS3Client s3object = new AmazonS3Client(basicSessionCredentials);
        // Test. For example, get object keys for a given bucket.
        ObjectListing objects = s3object.listObjects(bucketName);
        s3object.getObject( new GetObjectRequest(bucketName, key));
        System.out.println("No. of Objects = "
                + objects.getObjectSummaries().size());
    }
}

This code generate the dynamically access key,secret key and security token.Now i need to generate url with authorization header with signature so that i can access S3 object directly.Is there way?

From this code i want to generate url using x-amz-security-token

1 Answer 1

5

if you want to do this in java, you have to use AmazonS3.generatePresignedUrl

AmazonS3 s3client = new AmazonS3Client(new ProfileCredentialsProvider()); 

java.util.Date expiration = new java.util.Date();
long msec = expiration.getTime();
msec += 1000 * 60 * 60; // 1 hour.
expiration.setTime(msec);

GeneratePresignedUrlRequest generatePresignedUrlRequest = 
              new GeneratePresignedUrlRequest(bucketName, objectKey);
generatePresignedUrlRequest.setMethod(HttpMethod.GET); // Default.
generatePresignedUrlRequest.setExpiration(expiration);

URL s = s3client.generatePresignedUrl(generatePresignedUrlRequest); 

if you want to do this from the console, go to you s3 bucket, click download on the object. This displays a box where you can click on "download". If you right click on this link and copy the address link, you get a pre-signed url for this object

10
  • @Tom-I want to generate url using STS using following code- AWSSecurityTokenServiceClient stsClient = new AWSSecurityTokenServiceClient( new ProfileCredentialsProvider()); How to generate https url using temporary security credential using x-amz-security-token.Please help Commented Jan 21, 2016 at 9:40
  • STS is a web service that enables you to request temporary credentials for IAM users or federated users, but this is not a way to obtain a pre-signed url for s3. What you can do is: first use sts to obtain temporary IAM credentials (with a policy allowing you to get objects from s3), and then pre-sign urls with generatePresignedUrl as shown in my answer, using these temporary credentials. Please note that a pre-signed url is temporary valid and "uses" temporary credentials behind the scene.
    – Tom
    Commented Jan 21, 2016 at 9:54
  • if needed, here is how to create a client with temporary credentials: BasicSessionCredentials basic_session_creds = new BasicSessionCredentials( session_creds.getAccessKeyId(), session_creds.getSecretAccessKey(), session_creds.getSessionToken()); AmazonS3Client s3 = new AmazonS3Client(basic_session_creds);
    – Tom
    Commented Jan 21, 2016 at 9:55
  • @Tom-I have generate the temporary credential like access key,secret key and security token.Please find the attached code..Now I need to generate url using these credential with authorization header with signature Commented Jan 21, 2016 at 10:21
  • 1
    "I want to generate url using temporary credential(access key,secret key,and token) share the this url to client to access S3 object" ==> this is the definition of a pre-signed url, see docs.aws.amazon.com/fr_fr/AmazonS3/latest/dev/…. A pre-singed url does not embed your credentials, so no need to generate it using temporary credentials.
    – Tom
    Commented Jan 21, 2016 at 10:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.