1

I'm thinking about signing up to the Amazon S3 storage service.

What I want to do is create a service where other people can register their own bucket with a certain amount of storage.

These users will install my software, which then uploads their files. Of course, the users may only upload what they have paid for.

For this to work I would like to create a separate bucket for each customer, each with its own properties. Question 1: is this possible with the API? How?

This means that the installed software must have the rights needed to upload to my Amazon S3 account. Question 2: can I create individual authentication IDs for each bucket or customer, so that they can only upload with restrictions I have set?

Important info: I am a European resident and cannot do business in the United States, this means that I cannot use Amazon's DevPay service.

Update: looks like Amazon has a 100 buckets limit. This is not my service it seems. http://seocracy.com/2009/08/amazon-s3-bucket-limit/

Thanks in advance.

1 Answer 1

1

You can always hide the buckets behind a virtualization app (a HTTP front end, an FTP one, or something custom). But that means you would have to burn CPU, probably on an EC2 instance, to map these requests and copy bytes in/out of those S3 buckets.

Exposing an S3 bucket directly to a user would have to follow the S3 security rules:

How can I control access to my data stored on Amazon S3?
Customers may use three mechanisms for controlling access to Amazon S3 resources: bucket policies, Access Control Lists (ACLs) and query string authentication. With bucket policies, companies can define rules which apply broadly across all requests to their Amazon S3 resources, such as granting write privileges to a subset of Amazon S3 resources. Customers can also restrict access based on an aspect of the request, such as HTTP referrer and IP address. With ACLs, customers can grant specific permissions (i.e. READ, WRITE, FULL_CONTROL) to specific users for an individual bucket or object. With query string authentication, customers can create a URL to an Amazon S3 object which is only valid for a limited time.

8
  • Thanks, but could you please clarify if I can create a bucket policy that restrits a user to only upload to a certain bucket with a maximum storage and monthly transfer amount? Where do you read this?
    – Tom
    Dec 29, 2010 at 19:06
  • Afaik to put such traffic/size restriction in effect you must have your own front end that exposes the 'service' and access S3 from behind this front end. Dec 29, 2010 at 19:12
  • @Remus Rusanu, is that the only way? That would be almost undoable, because it would rain way too much server resources and bandwidth inbetween.
    – Tom
    Dec 29, 2010 at 19:25
  • If your customers have each an AWS account then you can expose the S3 directly and control via ACLs. Other solutions are not exactly bulletproof: HTTP referrer can be spoofed, IP restrictions are unreliable with customers behind NATs and impossible to maintain, query string authentication and limited time access has only a few limited use cases when it can be used. I'm curious myself if someone has a solution that safely exposes the S3 bucket directly, but I'm not aware of any. Dec 29, 2010 at 20:31
  • @Remus Rusana, what kind of AWS account do they need? How does this work? If you mean a master AWS account for developers, like I have, that really is not an option. This is a service for non-technical consumers. This is rather disappointing.
    – Tom
    Dec 29, 2010 at 20:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .