Creating a Pre-Signed URL

You can create a pre-signed URL to temporarily grant access to a specific Object Storage operation without sharing permanent credentials. Depending on how it is generated, a pre-signed URL can allow users to download an existing object or upload an object to a specific bucket and object key.

Any user to whom you send the pre-signed URL can perform the authorized operation for the time you specify. The user does not need their own permissions or authentication on the bucket.

You can create a pre-signed URL to:

  • Download or share an existing object.

  • Upload an object using a single PUT request.

  • Pre-signed URLs for PUT uploads are supported.

  • Pre-signed POST uploads are not supported.

  • A pre-sign URL is also required when copying an OUTSCALE machine image (OMI) between OUTSCALE accounts located in different Regions. For more information, see Copying an OMI Across Regions.

  • The pre-signed URL that is generated to copy an OMI is valid for 7 days.

Creating a Pre-Signed URL to Upload an Object Using AWS CLI

Before you begin: Install and configure AWS CLI. For more information, see Installing and Configuring AWS CLI.

To create a pre-signed URL, use the presign command following this syntax:

Request sample
$ aws s3 presign s3://BUCKET/OBJECT \
    --profile YOUR_PROFILE \
    --expires-in 3600 \
    --endpoint https://oos.eu-west-2.outscale.com

This command contains the following options that you need to specify:

  • (optional) profile: The named profile you want to use, created when configuring AWS CLI. For more information, see Installing and Configuring AWS CLI.

  • s3://BUCKET/OBJECT: The path to the object you want to share in its bucket.

  • expires-in: The time left before the URL expires, in seconds.

    When using AWS CLI, the maximum duration for a pre-signed URL is 604800 seconds (1 week).

  • endpoint: The endpoint corresponding to the Region you want to send the request to. For more information, see Installing and Configuring AWS CLI.

The presign command returns the following element:

  • URL: The URL at which your object is available.

Result sample
https://oos.eu-west-2.outscale.com/BUCKET/OBJECT?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=ABCDEFGHIJ0123456789%2F20101001%2Feu-west-2%2Fs3%2Faws4_request&X-Amz-Date=20101001T123456Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&X-Amz-Signature=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Creating a Pre-Signed URL Using s3cmd

You can manage your object storage resources using s3cmd commands. For more information, see s3cmd.

Tutorial: Creating and Using a Pre-Signed URL to Upload an Object

Before you begin:

  1. If the pre-signed URL is used from a browser, configure CORS on the bucket first:

    Request sample
    $ aws s3api put-bucket-cors \
    --profile YOUR_PROFILE \
    --bucket BUCKET \
    --cors-configuration file://MY_CORS_CONFIG.json \
    --endpoint https://oos.eu-west-2.outscale.com
    CORS configuration sample
    {
  "CORSRules": [
    {
      "AllowedHeaders": ["*"],
      "ExposeHeaders": ["ETag", "x-amz-meta-tag"],
      "AllowedMethods": ["PUT"],
      "MaxAgeSeconds": 3000,
      "AllowedOrigins": ["http://example.com"]
    }
  ]
}

    For more information, see Applying a CORS Configuration to a Bucket.

  2. Create a Python script to generate the pre-signed URL for the PUT upload:

    Request sample
    $ vi generate_presigned_put_url.py

    This command opens a new file named generate_presigned_put_url.py in the vi text editor.

  3. Add the following content to the file:

    File sample
    import boto3

s3 = boto3.client(
    "s3",
    endpoint_url="https://oos.eu-west-2.outscale.com",
    aws_access_key_id="ACCESS_KEY",
    aws_secret_access_key="SECRET_KEY"
)

response = s3.generate_presigned_url(
    ClientMethod="put_object",
    Params={
        "Bucket": "BUCKET",
        "Key": "OBJECT",
        "ContentType": "text/plain"
    },
    ExpiresIn=3600
)

print(response)

    If you use the vi text editor, press i to enter insert mode before pasting the sample.

    After pasting the sample, press Esc, then type :wq and press Enter to save the file and exit the text editor.

    The script contains the following options that you need to specify:

    • ACCESS_KEY: The access key of the account used to sign the pre-signed URL.

    • SECRET_KEY: The secret key of the account used to sign the pre-signed URL.

    • BUCKET: The name of the bucket to which the object is uploaded.

    • OBJECT: The name of the object to be uploaded in the bucket.

    • (optional) ContentType: The content type expected in the upload request. If specified, the upload request must include the matching Content-Type header.

    • (optional) ExpiresIn: The validity period of the pre-signed URL, in seconds. If not specified, boto3 will use a default value of 3600 seconds.

  4. Generate the pre-signed URL and store it in a shell variable:

    Request sample
    $ PRESIGNED_URL=$(python3 generate_presigned_put_url.py)

  5. Print the generated URL:

    Request sample
    $ echo "$PRESIGNED_URL"

    The command returns a URL containing query parameters such as X-Amz-Algorithm, X-Amz-Credential, X-Amz-Date, X-Amz-Expires, X-Amz-SignedHeaders, and X-Amz-Signature.

  6. Create the local file that will be uploaded as the object specified by OBJECT in the Python script (here, uploadme.txt):

    Request sample
    $ cat > uploadme.txt <<'EOF'
Test upload
EOF

  7. Upload the object using the pre-signed URL:

    Request sample
    $ curl -i --request PUT --upload-file uploadme.txt \
    -H "Content-Type: text/plain" \
    "$PRESIGNED_URL"

    If the upload succeeds, the command returns an HTTP 200 OK status code, an ETag header, and request identifiers such as x-amz-request-id and x-amz-id-2.

    If the header is missing or uses a different value, the signature validation fails and the upload is rejected.

  8. Verify that the object was successfully uploaded:

    Request sample
    $ aws s3api list-objects-v2 \
    --profile PROFILE \
    --bucket BUCKET \
    --endpoint https://oos.eu-west-2.outscale.com

    For more information, see Listing the Objects of a Bucket.

Related Page

AWS™ and Amazon Web Services™ are trademarks of Amazon Technologies, Inc or its affiliates in the United States and/or other countries.

Export to PDF