Question

I need to provide individuals with their financial statement, and I am using S3. So far what I am doing is making the file public-read and creating a unique Key, using uuid.uuid4().

Would this be acceptable, or how else could I make this more secure? Sending authentication keys for each individual is not an option.

Answer 1

Have you considered generating expiring urls for the files on S3.

from boto.s3.connection import S3Connection

conn = S3Connection(AWS_ACCESS_KEY_ID,
                    AWS_SECRET_ACCESS_KEY, is_secure=False)

# The generated temp_url remains valid for 60 seconds in this case
temp_url = conn.generate_url(60, 'GET', bucket=bucket_name, 
                             key=file_name, force_http=True)