I have a private S3 Bucket that contains a lot of folders (currently 1000 folders). The amount of folders changes (new ones are added, old ones deleted). Every customer has to register and log in to the application, which uses AWS Cognito, to access those folders over a fronted. A user can only access specific folders within the S3 Bucket, it could be 10 folders, but also all of them.

In the application, an admin user can grant access to a folder for a user. Those permission need to be stored somewhere (like DynamoDB)

  • User A: can access folder-a, folder-b
  • User B: can access folder-b, folder-c
  • User C: can access folder-c

How should it work:

  1. A user (logged in) sends a request to: https:///some-folder/some-file
  2. only if the user has the required permissions to 'some-folder' the file is returned

What doesn't work:

Is that possible without:

  • having a lambda function, that is used to check permissions, since it needs to download the accessed file and is limited by file size and time.
  • pre-signed URLs, since they change and require 2 request to get one file (get the URL, fetch the resource)


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.