5 ms·
I don't understand the details of cloud stuff, and it took me a heck of a long time to google just what a "pre-signed URL" was. In case anybody else is in the s
by jfengel 3y ago
I don't understand the details of cloud stuff, and it took me a heck of a long time to google just what a "pre-signed URL" was. In case anybody else is in the same bucket (ahem):
Users can't upload to your S3 storage because they lack credentials. (It would be dangerous to make it public.) But you can give them access with a specially-generated URL (generated for each time they want to upload). So your server makes a special URL, "signed" with its own authorization. That lets them upload one file, to that specific URL.
(I dunno about anybody else, but I find working with AWS always involves cramming in a lot of security-related concepts that I had never had to think about before. It puts a lot of overhead on simple operations, but presumably is mandatory if you want an application accessible to the world.)
- ilogik 3y agoyou can use an EBS volume attached to the pod, or shared EFS volume as well. but for certain applications, s3 is simpler to use, especially when you need to scale
- jfengel 3y agoI have zero idea what an EBS, EFS, or pod is. Not that I'm asking for an explanation. Just illustrating how much stuff there is to learn for the basic operation of "run this on your computer", even for an experienced developer. (I've been doing this for nearly 40 years.)
- danrob 3y agoYou should probably learn.
- roland35 3y agoI took a class for AWS certification. Even though I never ended up taking the test, it has been extremely helpful throughout my career.
- jfengel 3y agoIf I ever need it, I will. It's not useful in my area of work so I haven't bothered. I am curious, so I took the opportunity to look up the strange sounding term "pre signed url". But that's just being a dilettante.
- bombela 3y agoIt's a cool feature. You don't need to proxy the upload via your web server. But instead it is directly handled by AWS. It's nost likely more efficient, faster, and cheaper (no need to handle the traffic and hardware to proxy).
- busymom0 3y agopre-signed URLs also allow you to set conditions such as file size limit, type of file, file name etc to ensure malicious party isn't uploading a massive 1 TB file into your bucket which you serve as profile pics. However, while amazon S3 supports these "conditions", others like backblaze implementing S3 may or may not implement it. So beware.
- gehen88 3y agoNote that limiting content length only works with createPresignedPost, not with getSignedUrl.
- junto 3y agoBoth Azure and AWS have this feature and it’s very useful to avoid having to proxy large files through your own backend.
- rendaw 3y agoCalling it a "single use upload url" would probably be a lot clearer. Describe the purpose, not the mechanism...
- freedomben 3y agoSingle use upload URL isn't the only use case for pre-signed URLs though. They are more commonly used for quick-expiring downloads for example.
- jfengel 3y agoIt sure sounds like it. I'm not sure how much of AWS could be clarified by better names, but I suspect it's a lot.
- cqqxo4zV46cp 3y agoIf you were building a system with the same architecture, you’d have the same security considerations. Nobody is telling you to use pre-signed URLs, even if you’re using AWS. This is an apples and oranges comparison. A seasoned technologist such as yourself should be able to see past the word “cloud”, understand the architectural differences and the engineering trade offs being made. It’s evident from your comments that you seem to wear this ignorance as a point of pride. I’m no tech hipster and I can still see that this isn’t the good look that you think it is.