@aws-sdk/s3-request-presigner

This package provides a presigner based on signature V4 that will attempt to generate signed url for S3.

Get Presigned URL with Client and Command

You can generated presigned url from S3 client and command. Here's the example:

1import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
2import { S3Client, GetObjectCommand } from "@aws-sdk/client-s3";
3const client = new S3Client(clientParams);
4const command = new GetObjectCommand(getObjectParams);
5const url = await getSignedUrl(client, command, { expiresIn: 3600 });

You can get signed URL for other S3 operations too, like PutObjectCommand. expiresIn config from the examples above is optional. If not set, it's default at 900.

If you already have a request, you can pre-sign the request following the section bellow.

Get Presigned URL from an Existing Request

1import { S3RequestPresigner } from "@aws-sdk/s3-request-presigner";
2import { Sha256 } from "@aws-crypto/sha256-browser";
3import { Hash } from "@aws-sdk/hash-node";
4const signer = new S3RequestPresigner({
5  region: regionProvider,
6  credentials: credentialsProvider,
7  sha256: Hash.bind(null, "sha256"), // In Node.js
8  //sha256: Sha256 // In browsers
9});
10const presigned = await signer.presign(request);

To avoid redundant construction parameters when instantiating the s3 presigner, you can simply spread the configuration of an existing s3 client and supply it to the presigner's constructor.

1//s3 is instantiated from S3Client from @aws-sdk/client-s3-* packages
2const signer = new S3RequestPresigner({
3  ...s3.config,
4});

Get Presigned URL with headers that cannot be signed

By using the getSignedUrl with a S3Client you are able to sign your headers, improving the security of presigned url. Importantly, if you want to sign any x-amz-* headers (like the ChecksumSHA256 header in this example), you need to provide those headers to the set of unhoistableHeaders in the getSignedUrl params which will force those headers to be present in the upload request.

1import { PutObjectCommand, S3Client } from "@aws-sdk/client-s3";
2import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
3
4const s3Client = new S3Client({ region: "us-east-1" });
5const command = new PutObjectCommand({
6  Bucket: bucket,
7  Key: key,
8  ChecksumSHA256: sha,
9});
10
11const presigned = getSignedUrl(s3Client, command, {
12  expiresIn: expiration,
13  // Set of all x-amz-* headers you wish to have signed
14  unhoistableHeaders: new Set(["x-amz-checksum-sha256"]),
15});

Get Presigned URL with headers that should be signed

For headers that are not x-amz-* you are able to add them to the set of signableHeaders to be enforced in the presigned urls request.

1import { PutObjectCommand, S3Client } from "@aws-sdk/client-s3";
2import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
3
4const s3Client = new S3Client({ region: "us-east-1" });
5const command = new PutObjectCommand({
6  Bucket: bucket,
7  Key: key,
8  ContentType: contentType,
9});
10
11const presigned = getSignedUrl(s3Client, command, {
12  signableHeaders: new Set(["content-type"]),
13  expiresIn: expiration,
14});

PutObject with use of hoistableHeaders

hoistableHeaders overrides the default behavior of not hoisting any headers that begin with x-amz-*.

1// example: Server Side Encryption headers
2import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
3import { S3Client, PutObjectCommand } from "@aws-sdk/client-s3";
4
5const params = {
6  Key: "...",
7  Bucket: "...",
8  ServerSideEncryption: "aws:kms",
9  SSEKMSKeyId: "arn:aws:kms:us-west-2:0000:key/abcd-1234-abcd",
10};
11const s3Client = new S3Client();
12const command = new PutObjectCommand(params);
13
14const preSignedUrl = await getSignedUrl(s3Client, command, {
15  hoistableHeaders: new Set(["x-amz-server-side-encryption", "x-amz-server-side-encryption-aws-kms-key-id"]),
16});