@aws-sdk/s3-request-presigner

What is @aws-sdk/s3-request-presigner?

The @aws-sdk/s3-request-presigner package is part of the AWS SDK for JavaScript (v3) and is used to generate pre-signed URLs for AWS S3 objects. This allows clients to perform operations on S3 objects, such as GET or PUT, without requiring AWS credentials, by providing a URL that includes a signature. This is useful for providing temporary access to private objects, uploading files directly from a browser, or any other operation that you want to allow without giving out AWS credentials.

What are @aws-sdk/s3-request-presigner's main functionalities?

Generate pre-signed GET URL

This feature allows you to create a pre-signed URL for a GET request on an S3 object. The URL will be valid for the duration specified by 'expiresIn' (in seconds).

const { S3Client, GetObjectCommand } = require('@aws-sdk/client-s3');
const { getSignedUrl } = require('@aws-sdk/s3-request-presigner');

const s3Client = new S3Client({ region: 'us-west-2' });
const getObjectParams = { Bucket: 'my-bucket', Key: 'my-object-key' };
const command = new GetObjectCommand(getObjectParams);

const signedUrl = await getSignedUrl(s3Client, command, { expiresIn: 3600 });
console.log('The signed URL is:', signedUrl);

Generate pre-signed PUT URL

This feature allows you to create a pre-signed URL for a PUT request to upload an object to S3. The URL will be valid for the duration specified by 'expiresIn' (in seconds).

const { S3Client, PutObjectCommand } = require('@aws-sdk/client-s3');
const { getSignedUrl } = require('@aws-sdk/s3-request-presigner');

const s3Client = new S3Client({ region: 'us-west-2' });
const putObjectParams = { Bucket: 'my-bucket', Key: 'my-object-key' };
const command = new PutObjectCommand(putObjectParams);

const signedUrl = await getSignedUrl(s3Client, command, { expiresIn: 3600 });
console.log('The signed URL is:', signedUrl);

Other packages similar to @aws-sdk/s3-request-presigner

aws-sdk

The 'aws-sdk' package is the previous version of the AWS SDK for JavaScript. It also supports generating pre-signed URLs for S3 objects, but it is not modular like the newer '@aws-sdk/s3-request-presigner' and includes the entire AWS SDK.

README

@aws-sdk/s3-request-presigner

This package provides a presigner based on signature V4 that will attempt to generate signed url for S3.

Get Presigned URL with Client and Command

You can generated presigned url from S3 client and command. Here's the example:

import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
import { S3Client, GetObjectCommand } from "@aws-sdk/client-s3";
const client = new S3Client(clientParams);
const command = new GetObjectCommand(getObjectParams);
const url = await getSignedUrl(client, command, { expiresIn: 3600 });

You can get signed URL for other S3 operations too, like PutObjectCommand. expiresIn config from the examples above is optional. If not set, it's default at 900.

If you already have a request, you can pre-sign the request following the section bellow.

Get Presigned URL from an Existing Request

import { S3RequestPresigner } from "@aws-sdk/s3-request-presigner";
import { Sha256 } from "@aws-crypto/sha256-browser";
import { Hash } from "@aws-sdk/hash-node";
const signer = new S3RequestPresigner({
  region: regionProvider,
  credentials: credentialsProvider,
  sha256: Hash.bind(null, "sha256"), // In Node.js
  //sha256: Sha256 // In browsers
});
const presigned = await signer.presign(request);

To avoid redundant construction parameters when instantiating the s3 presigner, you can simply spread the configuration of an existing s3 client and supply it to the presigner's constructor.

//s3 is instantiated from S3Client from @aws-sdk/client-s3-* packages
const signer = new S3RequestPresigner({
  ...s3.config,
});

Get Presigned URL with headers that cannot be signed

By using the getSignedUrl with a S3Client you are able to sign your headers, improving the security of presigned url. Importantly, if you want to sign any x-amz-* headers (like the ChecksumSHA256 header in this example), you need to provide those headers to the set of unhoistableHeaders in the getSignedUrl params which will force those headers to be present in the upload request.

import { PutObjectCommand, S3Client } from "@aws-sdk/client-s3";
import { getSignedUrl } from "@aws-sdk/s3-request-presigner";

const s3Client = new S3Client({ region: "us-east-1" });
const command = new PutObjectCommand({
  Bucket: bucket,
  Key: key,
  ChecksumSHA256: sha,
});

const presigned = getSignedUrl(s3Client, command, {
  expiresIn: expiration,
  // Set of all x-amz-* headers you wish to have signed
  unhoistableHeaders: new Set(["x-amz-checksum-sha256"]),
});

Get Presigned URL with headers that should be signed

For headers that are not x-amz-* you are able to add them to the set of signableHeaders to be enforced in the presigned urls request.

import { PutObjectCommand, S3Client } from "@aws-sdk/client-s3";
import { getSignedUrl } from "@aws-sdk/s3-request-presigner";

const s3Client = new S3Client({ region: "us-east-1" });
const command = new PutObjectCommand({
  Bucket: bucket,
  Key: key,
  ContentType: contentType,
});

const presigned = getSignedUrl(s3Client, command, {
  signableHeaders: new Set(["content-type"]),
  expiresIn: expiration,
});

PutObject with use of hoistableHeaders

hoistableHeaders overrides the default behavior of not hoisting any headers that begin with x-amz-*.

// example: Server Side Encryption headers
import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
import { S3Client, PutObjectCommand } from "@aws-sdk/client-s3";

const params = {
  Key: "...",
  Bucket: "...",
  ServerSideEncryption: "aws:kms",
  SSEKMSKeyId: "arn:aws:kms:us-west-2:0000:key/abcd-1234-abcd",
};
const s3Client = new S3Client();
const command = new PutObjectCommand(params);

const preSignedUrl = await getSignedUrl(s3Client, command, {
  hoistableHeaders: new Set(["x-amz-server-side-encryption", "x-amz-server-side-encryption-aws-kms-key-id"]),
});

Changelog

3.703.0 (2024-12-02)

Features

• client-bedrock-agent-runtime: This release introduces a new Rerank API to leverage reranking models (with integration into Knowledge Bases); APIs to upload documents directly into Knowledge Base; RetrieveAndGenerateStream API for streaming response; Guardrails on Retrieve API; and ability to automatically generate filters (4ed232e)
• client-bedrock-agent: This release introduces APIs to upload documents directly into a Knowledge Base (908a395)
• client-bedrock: Add support for Knowledge Base Evaluations & LLM as a judge (ac2bf51)
• client-chime-sdk-voice: This release adds supports for enterprises to integrate Amazon Connect with other voice systems. It supports directly transferring voice calls and metadata without using the public telephone network. It also supports real-time and post-call analytics. (79dd462)
• client-cleanrooms: This release allows customers and their partners to easily collaborate with data stored in Snowflake and Amazon Athena, without having to move or share their underlying data among collaborators. (7447521)
• client-cloudwatch-logs: Adds PutIntegration, GetIntegration, ListIntegrations and DeleteIntegration APIs. Adds QueryLanguage support to StartQuery, GetQueryResults, DescribeQueries, DescribeQueryDefinitions, and PutQueryDefinition APIs. (dc60c6f)
• client-connect: Adds support for WhatsApp Business messaging, IVR call recording, enabling Contact Lens for existing on-premise contact centers and telephony platforms, and enabling telephony and IVR migration to Amazon Connect independent of their contact center agents. (f6492f5)
• client-connectcampaignsv2: Amazon Connect Outbound Campaigns V2 / Features : Adds support for Event-Triggered Campaigns. (1bea595)
• client-customer-profiles: This release introduces Event Trigger APIs as part of Amazon Connect Customer Profiles service. (a4af58b)
• client-ec2: Adds support for declarative policies that allow you to enforce desired configuration across an AWS organization through configuring account attributes. Adds support for Allowed AMIs that allows you to limit the use of AMIs in AWS accounts. Adds support for connectivity over non-HTTP protocols. (478480a)
• client-eks: Added support for Auto Mode Clusters, Hybrid Nodes, and specifying computeTypes in the DescribeAddonVersions API. (41cd745)
• client-eventbridge: Call private APIs by configuring Connections with VPC connectivity through PrivateLink and VPC Lattice (224d5a7)
• client-fsx: FSx API changes to support the public launch of the Amazon FSx Intelligent Tiering for OpenZFS storage class. (bed4377)
• client-guardduty: Add new Multi Domain Correlation findings. (b2a4c95)
• client-imagebuilder: Added support for EC2 Image Builder's integration with AWS Marketplace for Marketplace components. (967f0c2)
• client-invoicing: AWS Invoice Configuration allows you to receive separate AWS invoices based on your organizational needs. You can use the AWS SDKs to manage Invoice Units and programmatically fetch the information of the invoice receiver. (263848d)
• client-memorydb: Amazon MemoryDB SDK now supports all APIs for Multi-Region. Please refer to the updated Amazon MemoryDB public documentation for detailed information on API usage. (73a9ef4)
• client-networkflowmonitor: This release adds documentation for a new feature in Amazon CloudWatch called Network Flow Monitor. You can use Network Flow Monitor to get near real-time metrics, including retransmissions and data transferred, for your actual workloads. (e7dc6a2)
• client-opensearch: This feature introduces support for CRUDL APIs, enabling the creation and management of Connected data sources. (9f110aa)
• client-organizations: Add support for policy operations on the DECLARATIVE_POLICY_EC2 policy type. (2af53c3)
• client-qbusiness: Amazon Q Business now supports capabilities to extract insights and answer questions from visual elements embedded within documents, a browser extension for Google Chrome, Mozilla Firefox, and Microsoft Edge, and attachments across conversations. (45e207b)
• client-qconnect: This release adds following capabilities: Configuring safeguards via AIGuardrails for Q in Connect inferencing, and APIs to support Q&A self-service use cases (8730906)
• client-rds: Amazon RDS supports CloudWatch Database Insights. You can use the SDK to create, modify, and describe the DatabaseInsightsMode for your DB instances and clusters. (e2236af)
• client-s3-control: Amazon S3 introduces support for AWS Dedicated Local Zones (f1a56b4)
• client-s3: Amazon S3 introduces support for AWS Dedicated Local Zones (a4b4303)
• client-security-ir: AWS Security Incident Response is a purpose-built security incident solution designed to help customers prepare for, respond to, and recover from security incidents. (7458eec)
• client-securityhub: Add new Multi Domain Correlation findings. (824c92f)
• client-transfer: AWS Transfer Family now offers Web apps that enables simple and secure access to data stored in Amazon S3. (77c2e6a)
• client-vpc-lattice: Lattice APIs that allow sharing and access of VPC resources across accounts. (a662822)
• clients: update client endpoints as of 2024-12-02 (5fffd4a)