How to control document access to S3 with NodeJS / Express - node.js

Question

I’ve done a fair amount of research on this question, and surprisingly haven’t found anything relevant. Perhaps I am missing the right keywords to search for!
My app has a requirement for users to upload files to it. These will go into Amazon S3. I have worked out how to upload to S3 using one single user permissioned through IAM.
A further requirement is that a user can only access the files they have uploaded. User 1 cannot access User 2’s documents. In due course, I would also like to enable User 1 to grant User 2 permissions to, say, a collection of User 1’s documents.
I’m struggling to work out how to implement this. There are a few options I think:
One single bucket, one single IAM user. The permissions are completely controlled through the backend in Express/NodeJS. This would be the simplest implementation for me, but I’m concerned that my permissions are not mirrored in S3. Is that a security risk?
Multiple buckets, create IAM users on the fly through Express. I presume this is technically possible, but presumably would lead to me storing IAM credentials in my app’s database. That sounds like a no-no to me.
Using Auth0 delegation and generating a temporary token in AWS. (My app uses Auth0 to authenticate users).This sounds quite complicated and I can’t find a good enough tutorial to get me clued up enough on this. Perhaps this is the best way forward, but is it substantially different from (1)?
If anybody has any experience with this it would be much appreciated if you could point me in the right direction!

Answer 1

I have no prior experience with your current problem but I did some research because I am currently preparing for an AWS exam and the question interests me.
If your bucket have multiple folders inside (one for each user), I found out you can restrict the access by specifying an IAM policy by user.
For instance:
{
"Version":"2012-10-17",
"Statement": [
{
"Sid": "AllowUserToSeeBucketListInTheConsole",
"Action": ["s3:ListAllMyBuckets", "s3:GetBucketLocation"],
"Effect": "Allow",
"Resource": ["arn:aws:s3:::*"]
},
{
"Sid": "AllowRootAndHomeListingOfCompanyBucket",
"Action": ["s3:ListBucket"],
"Effect": "Allow",
"Resource": ["arn:aws:s3:::my-company"],
"Condition":{"StringEquals":{"s3:prefix":["","home/", "home/David"],"s3:delimiter":["/"]}}
},
{
"Sid": "AllowListingOfUserFolder",
"Action": ["s3:ListBucket"],
"Effect": "Allow",
"Resource": ["arn:aws:s3:::my-company"],
"Condition":{"StringLike":{"s3:prefix":["home/David/*"]}}
},
{
"Sid": "AllowAllS3ActionsInUserFolder",
"Effect": "Allow",
"Action": ["s3:*"],
"Resource": ["arn:aws:s3:::my-company/home/David/*"]
}
]
}
Or event better, you can use policy variables and create a single policy that applies to all your users:
{
"Version":"2012-10-17",
"Statement": [
{
"Sid": "AllowGroupToSeeBucketListInTheConsole",
"Action": ["s3:ListAllMyBuckets", "s3:GetBucketLocation"],
"Effect": "Allow",
"Resource": ["arn:aws:s3:::*"]
},
{
"Sid": "AllowRootAndHomeListingOfCompanyBucket",
"Action": ["s3:ListBucket"],
"Effect": "Allow",
"Resource": ["arn:aws:s3:::my-company"],
"Condition":{"StringEquals":{"s3:prefix":["","home/"],"s3:delimiter":["/"]}}
},
{
"Sid": "AllowListingOfUserFolder",
"Action": ["s3:ListBucket"],
"Effect": "Allow",
"Resource": ["arn:aws:s3:::my-company"],
"Condition":{"StringLike":{"s3:prefix":
[
"home/${aws:username}/*",
"home/${aws:username}"
]
}
}
},
{
"Sid": "AllowAllS3ActionsInUserFolder",
"Action":["s3:*"],
"Effect":"Allow",
"Resource": ["arn:aws:s3:::my-company/home/${aws:username}/*"]
}
]
}
Source: https://aws.amazon.com/fr/blogs/security/writing-iam-policies-grant-access-to-user-specific-folders-in-an-amazon-s3-bucket/
Hope it helps!