Question

When I had my hard-coded access key and secret key present, I was able to generate authenticated urls for users to view private files on S3. This was done with the following code:

import hmac
import sha
import urllib
import time

filename = "".join([s3_url_prefix, filename])
expiry = str(int(time.time()) + 3600)
h = hmac.new(
    current_app.config.get("S3_SECRET_KEY", None),
    "".join(["GET\n\n\n", expiry, "\n", filename]),
    sha
)
signature = urllib.quote_plus(base64.encodestring(h.digest()).strip())
return "".join([
    "https://s3.amazonaws.com",
    filename,
    "?AWSAccessKeyId=",
    current_app.config.get("S3_ACCESS_KEY", None),
    "&Expires=",
    expiry,
    "&Signature=",
    signature
])

Which gave me something to the effect of https://s3.amazonaws.com/bucket_name/path_to_file?AWSAccessKeyId=xxxxx&Expires=5555555555&Signature=eBFeN32eBb2MwxKk4nhGR1UPhk%3D. Unfortunately, I am unable to store keys in config files for security reasons. For this reason, I switched over to IAM roles. Now, I get my keys using:

_iam = boto.connect_iam()

S3_ACCESS_KEY = _iam.access_key
S3_SECRET_KEY = _iam.secret_key

However, this gives me the error “The AWS Access Key Id you provided does not exist in our records.”. From my research, I understand that this is because my IAM keys aren’t the actual keys, but instead used with a token. My question therefore, is twofold:

1. How do I get the token programatically? It doesn’t seem that there is a simple iam property I can use.

2. How do I send the token in the signature? I believe my signature should end up looking something like “”.join([“GET\n\n\n”, expiry, “\n”, token, filename]), but I can’t figure out what format to use.

Any help would be greatly appreciated.

Answer 1

There was a change to the generate_url method in https://github.com/boto/boto/commit/99e14f3df039997f54a5377cb6aecc83f22c2670 (June 2012) that made it possible to sign a URL using session credentials. That means you would need to be using a boto version 2.6.0 or later. If you are, you should be able to just do this:

import boto
s3 = boto.connect_s3()
url = s3.generate_url(expires_in=3600, method='GET', bucket='<bucket_name>', key='<key_name>')

What version are you using?