software.amazon.awssdk.services.s3.presigner.model.PresignedGetObjectRequest Java Examples

private String getS3Url(String objectKey) {
    AwsCredentialsProvider credentialsProvider = StaticCredentialsProvider.create(AwsBasicCredentials.create(accessKey, secretKey));
    S3Presigner preSigner = S3Presigner.builder()
            .credentialsProvider(credentialsProvider)
            .endpointOverride(URI.create(endpoint))
            .region(clientRegion).build();
    GetObjectRequest getObjectRequest = GetObjectRequest.builder()
            .bucket(bucketName)
            .key(objectKey)
            .build();
    GetObjectPresignRequest getObjectPresignRequest = GetObjectPresignRequest.builder()
            .getObjectRequest(getObjectRequest).signatureDuration(Duration.ofDays(7)).build();
    PresignedGetObjectRequest presignedGetObjectRequest = preSigner.presignGetObject(getObjectPresignRequest);
    String url = presignedGetObjectRequest.url().toString();
    preSigner.close();
    return url;
}
 

/**
 * When dualstack and accelerate are both enabled there is a special, global dualstack endpoint we must use.
 */
@Test
public void dualstackAndAccelerateEnabled_UsesDualstackAccelerateEndpoint() throws Exception {
    S3Presigner presigner = presignerBuilder().serviceConfiguration(S3Configuration.builder()
            .dualstackEnabled(true)
            .accelerateModeEnabled(true)
            .build())
            .build();

    PresignedGetObjectRequest presignedRequest =
            presigner.presignGetObject(r -> r.signatureDuration(Duration.ofMinutes(5))
                    .getObjectRequest(go -> go.bucket(BUCKET)
                            .key("bar")));

    assertThat(presignedRequest.httpRequest().host()).isEqualTo(String.format("%s.s3-accelerate.dualstack.amazonaws.com", BUCKET));
}
 

/**
 * Dualstack also supports path style endpoints just like the normal endpoints.
 */
@Test
public void dualstackAndPathStyleEnabled_UsesPathStyleAddressingWithDualstackEndpoint() throws Exception {
    S3Presigner presigner = presignerBuilder().serviceConfiguration(S3Configuration.builder()
            .dualstackEnabled(true)
            .pathStyleAccessEnabled(true)
            .build())
            .build();

    PresignedGetObjectRequest presignedRequest =
            presigner.presignGetObject(r -> r.signatureDuration(Duration.ofMinutes(5))
                    .getObjectRequest(go -> go.bucket(BUCKET)
                            .key("bar")));

    assertThat(presignedRequest.httpRequest().host()).isEqualTo("s3.dualstack.us-west-2.amazonaws.com");
    assertThat(presignedRequest.url().toString()).startsWith(String.format("https://s3.dualstack.us-west-2.amazonaws.com/%s/%s?", BUCKET, "bar"));
}
 

@Test
public void getObject_S3ConfigurationCanBeOverriddenToLeverageTransferAcceleration() {
    S3Presigner presigner = presignerBuilder().serviceConfiguration(S3Configuration.builder()
                .accelerateModeEnabled(true)
                .build())
            .build();

    PresignedGetObjectRequest presignedRequest =
            presigner.presignGetObject(r -> r.signatureDuration(Duration.ofMinutes(5))
                    .getObjectRequest(go -> go.bucket("foo34343434")
                            .key("bar")));


    System.out.println(presignedRequest.url());

    assertThat(presignedRequest.httpRequest().host()).contains(".s3-accelerate.");
}
 

@Test
public void getObject_Sigv4PresignerHonorsSignatureDuration() {
    AwsRequestOverrideConfiguration override =
        AwsRequestOverrideConfiguration.builder()
                                       .signer(AwsS3V4Signer.create())
                                       .build();

    PresignedGetObjectRequest presigned =
        presigner.presignGetObject(r -> r.signatureDuration(Duration.ofSeconds(1234))
                                         .getObjectRequest(gor -> gor.bucket("a")
                                                                     .key("b")
                                                                     .overrideConfiguration(override)));

    assertThat(presigned.httpRequest().rawQueryParameters().get("X-Amz-Expires").get(0)).satisfies(expires -> {
        assertThat(expires).containsOnlyDigits();
        assertThat(Integer.parseInt(expires)).isCloseTo(1234, Offset.offset(2));
    });
}
 

@Test
public void getObject_AdditionalHeadersAndQueryStringsCanBeAdded() {
    AwsRequestOverrideConfiguration override =
        AwsRequestOverrideConfiguration.builder()
                                       .putHeader("X-Amz-AdditionalHeader", "foo1")
                                       .putRawQueryParameter("additionalQueryParam", "foo2")
                                       .build();

    PresignedGetObjectRequest presigned =
        presigner.presignGetObject(r -> r.signatureDuration(Duration.ofMinutes(5))
                                         .getObjectRequest(go -> go.bucket("foo34343434")
                                                                   .key("bar")
                                                                   .overrideConfiguration(override)));

    assertThat(presigned.isBrowserExecutable()).isFalse();
    assertThat(presigned.signedHeaders()).containsOnlyKeys("host", "x-amz-additionalheader");
    assertThat(presigned.signedHeaders().get("x-amz-additionalheader")).containsExactly("foo1");
    assertThat(presigned.httpRequest().headers()).containsKeys("x-amz-additionalheader");
    assertThat(presigned.httpRequest().rawQueryParameters().get("additionalQueryParam").get(0)).isEqualTo("foo2");
}
 

@Test
public void browserIncompatiblePresignedUrlWorksWithAdditionalHeaders() throws IOException {
    PresignedGetObjectRequest presigned =
        presigner.presignGetObject(r -> r.signatureDuration(Duration.ofMinutes(5))
                                         .getObjectRequest(gor -> gor.bucket(testBucket)
                                                                     .key(testGetObjectKey)
                                                                     .requestPayer(RequestPayer.REQUESTER)));

    assertThat(presigned.isBrowserExecutable()).isFalse();

    HttpURLConnection connection = (HttpURLConnection) presigned.url().openConnection();

    presigned.httpRequest().headers().forEach((header, values) -> {
        values.forEach(value -> {
            connection.addRequestProperty(header, value);
        });
    });

    try (InputStream content = connection.getInputStream()) {
        assertThat(IoUtils.toUtf8String(content)).isEqualTo(testObjectContent);
    }
}
 

@Test
public void browserIncompatiblePresignedUrlDoesNotWorkWithoutAdditionalHeaders() throws IOException {
    PresignedGetObjectRequest presigned =
        presigner.presignGetObject(r -> r.signatureDuration(Duration.ofMinutes(5))
                                         .getObjectRequest(gor -> gor.bucket(testBucket)
                                                                     .key(testGetObjectKey)
                                                                     .requestPayer(RequestPayer.REQUESTER)));

    assertThat(presigned.isBrowserExecutable()).isFalse();

    HttpURLConnection connection = (HttpURLConnection) presigned.url().openConnection();
    connection.connect();
    try {
        assertThat(connection.getResponseCode()).isEqualTo(403);
    } finally {
        connection.disconnect();
    }
}
 

@Test
public void accessPointArn_differentRegion_useArnRegionTrue() throws Exception {
    String customEndpoint = "https://foobar-12345678910.s3-accesspoint.us-west-2.amazonaws.com";
    String accessPointArn = "arn:aws:s3:us-west-2:12345678910:accesspoint:foobar";

    S3Presigner presigner = presignerBuilder().serviceConfiguration(S3Configuration.builder()
            .useArnRegionEnabled(true)
            .build())
            .build();

    PresignedGetObjectRequest presignedRequest =
            presigner.presignGetObject(r -> r.signatureDuration(Duration.ofMinutes(5))
                    .getObjectRequest(go -> go.bucket(accessPointArn)
                            .key("bar")));

    assertThat(presignedRequest.url().toString()).startsWith(customEndpoint);
}
 

@Test
public void getObject_PresignedHttpRequestCanBeInvokedDirectlyBySdk() throws IOException {
    PresignedGetObjectRequest presigned =
        presigner.presignGetObject(r -> r.signatureDuration(Duration.ofMinutes(5))
                                         .getObjectRequest(gor -> gor.bucket(testBucket)
                                                                     .key(testGetObjectKey)
                                                                     .requestPayer(RequestPayer.REQUESTER)));

    assertThat(presigned.isBrowserExecutable()).isFalse();

    SdkHttpClient httpClient = ApacheHttpClient.builder().build(); // or UrlConnectionHttpClient.builder().build()

    ContentStreamProvider requestPayload = presigned.signedPayload()
                                                    .map(SdkBytes::asContentStreamProvider)
                                                    .orElse(null);

    HttpExecuteRequest request = HttpExecuteRequest.builder()
                                                   .request(presigned.httpRequest())
                                                   .contentStreamProvider(requestPayload)
                                                   .build();

    HttpExecuteResponse response = httpClient.prepareRequest(request).call();

    assertThat(response.responseBody()).isPresent();
    try (InputStream responseStream = response.responseBody().get()) {
        assertThat(IoUtils.toUtf8String(responseStream)).isEqualTo(testObjectContent);
    }
}
 

@Test
public void getObject_SignatureIsUrlCompatible() {
    PresignedGetObjectRequest presigned =
        presigner.presignGetObject(r -> r.signatureDuration(Duration.ofMinutes(5))
                                         .getObjectRequest(go -> go.bucket("foo34343434")
                                                                   .key("bar")
                                                                   .responseContentType("text/plain")));
    assertThat(presigned.isBrowserExecutable()).isTrue();
    assertThat(presigned.signedHeaders().keySet()).containsExactly("host");
    assertThat(presigned.signedPayload()).isEmpty();
}
 

@Test
public void getObject_RequesterPaysIsNotUrlCompatible() {
    PresignedGetObjectRequest presigned =
        presigner.presignGetObject(r -> r.signatureDuration(Duration.ofMinutes(5))
                                         .getObjectRequest(go -> go.bucket("foo34343434")
                                                                   .key("bar")
                                                                   .requestPayer(RequestPayer.REQUESTER)));
    assertThat(presigned.isBrowserExecutable()).isFalse();
    assertThat(presigned.signedHeaders().keySet()).containsExactlyInAnyOrder("host", "x-amz-request-payer");
    assertThat(presigned.signedPayload()).isEmpty();
}
 

@Test
public void getObject_EndpointOverrideIsIncludedInPresignedUrl() {
    S3Presigner presigner = presignerBuilder().endpointOverride(URI.create("http://foo.com")).build();
    PresignedGetObjectRequest presigned =
        presigner.presignGetObject(r -> r.signatureDuration(Duration.ofMinutes(5))
                                         .getObjectRequest(go -> go.bucket("foo34343434")
                                                                   .key("bar")));

    assertThat(presigned.url().toString()).startsWith("http://foo.com/foo34343434/bar?");
    assertThat(presigned.isBrowserExecutable()).isTrue();
    assertThat(presigned.signedHeaders().get("host")).containsExactly("foo.com");
    assertThat(presigned.signedPayload()).isEmpty();
}
 

@Test
public void getObject_CredentialsCanBeOverriddenAtTheRequestLevel() {
    AwsCredentials clientCredentials = AwsBasicCredentials.create("a", "a");
    AwsCredentials requestCredentials = AwsBasicCredentials.create("b", "b");

    S3Presigner presigner = presignerBuilder().credentialsProvider(() -> clientCredentials).build();


    AwsRequestOverrideConfiguration overrideConfiguration =
        AwsRequestOverrideConfiguration.builder()
                                       .credentialsProvider(() -> requestCredentials)
                                       .build();

    PresignedGetObjectRequest presignedWithClientCredentials =
        presigner.presignGetObject(r -> r.signatureDuration(Duration.ofMinutes(5))
                                         .getObjectRequest(go -> go.bucket("foo34343434")
                                                                   .key("bar")));

    PresignedGetObjectRequest presignedWithRequestCredentials =
        presigner.presignGetObject(r -> r.signatureDuration(Duration.ofMinutes(5))
                                         .getObjectRequest(go -> go.bucket("foo34343434")
                                                                   .key("bar")
                                                                   .overrideConfiguration(overrideConfiguration)));

    System.out.println(presignedWithClientCredentials.url());

    assertThat(presignedWithClientCredentials.httpRequest().rawQueryParameters().get("X-Amz-Credential").get(0))
        .startsWith("a");
    assertThat(presignedWithRequestCredentials.httpRequest().rawQueryParameters().get("X-Amz-Credential").get(0))
        .startsWith("b");
}
 

private void assertThatPresigningWorks(String bucket, String objectKey) throws IOException {
    PresignedGetObjectRequest presigned =
        presigner.presignGetObject(r -> r.signatureDuration(Duration.ofMinutes(5))
                                         .getObjectRequest(gor -> gor.bucket(bucket).key(objectKey)));

    assertThat(presigned.isBrowserExecutable()).isTrue();

    try (InputStream response = presigned.url().openConnection().getInputStream()) {
        assertThat(IoUtils.toUtf8String(response)).isEqualTo(testObjectContent);
    }
}
 

@Override
public PresignedGetObjectRequest presignGetObject(GetObjectPresignRequest request) {
    return presign(PresignedGetObjectRequest.builder(),
                   request,
                   request.getObjectRequest(),
                   GetObjectRequest.class,
                   getObjectRequestMarshaller::marshall,
                   "GetObject")
        .build();
}
 

@Test
public void accelerateEnabled_UsesVirtualAddressingWithAccelerateEndpoint() {
    S3Presigner presigner = presignerBuilder().serviceConfiguration(S3Configuration.builder()
            .accelerateModeEnabled(true)
            .build())
            .build();

    PresignedGetObjectRequest presignedRequest =
            presigner.presignGetObject(r -> r.signatureDuration(Duration.ofMinutes(5))
                    .getObjectRequest(go -> go.bucket(BUCKET)
                            .key("bar")));

    assertThat(presignedRequest.httpRequest().host()).isEqualTo(String.format("%s.s3-accelerate.amazonaws.com", BUCKET));
}
 

/**
 * Dualstack uses regional endpoints that support virtual addressing.
 */
@Test
public void dualstackEnabled_UsesVirtualAddressingWithDualstackEndpoint() throws Exception {
    S3Presigner presigner = presignerBuilder().serviceConfiguration(S3Configuration.builder()
            .dualstackEnabled(true)
            .build())
            .build();

    PresignedGetObjectRequest presignedRequest =
            presigner.presignGetObject(r -> r.signatureDuration(Duration.ofMinutes(5))
                    .getObjectRequest(go -> go.bucket(BUCKET)
                            .key("bar")));

    assertThat(presignedRequest.httpRequest().host()).contains(String.format("%s.s3.dualstack.us-west-2.amazonaws.com", BUCKET));
}
 

@Override
public Object handle (TaskExecution aTask) throws Exception {
  AmazonS3URI s3Uri = new AmazonS3URI(aTask.getRequiredString("uri"));
  
  S3Presigner presigner = S3Presigner.create();
  
  PresignedGetObjectRequest presignedRequest =
      presigner.presignGetObject(z -> z.signatureDuration(Duration.parse("PT"+aTask.getRequiredString("signatureDuration")))
              .getObjectRequest(por -> por.bucket(s3Uri.getBucket()).key(s3Uri.getKey())));
  
  
  return presignedRequest.url().toString();
}
 

/**
 * Presign a {@link GetObjectRequest} so that it can be executed at a later time without requiring additional
 * signing or authentication.
 * <p />
 * This is a shorter method of invoking {@link #presignGetObject(GetObjectPresignRequest)} without needing
 * to call {@code GetObjectPresignRequest.builder()} or {@code .build()}.
 * 
 * @see #presignGetObject(GetObjectPresignRequest)
 */
default PresignedGetObjectRequest presignGetObject(Consumer<GetObjectPresignRequest.Builder> request) {
    GetObjectPresignRequest.Builder builder = GetObjectPresignRequest.builder();
    request.accept(builder);
    return presignGetObject(builder.build());
}
 

/**
 * Presign a {@link GetObjectRequest} so that it can be executed at a later time without requiring additional
 * signing or authentication.
 * <p/>
 *
 * <b>Example Usage</b>
 * <p/>
 *
 * <pre>
 * {@code
 *     S3Presigner presigner = ...;
 *
 *     // Create a GetObjectRequest to be pre-signed
 *     GetObjectRequest getObjectRequest = ...;
 *
 *     // Create a GetObjectPresignRequest to specify the signature duration
 *     GetObjectPresignRequest getObjectPresignRequest =
 *         GetObjectPresignRequest.builder()
 *                                .signatureDuration(Duration.ofMinutes(10))
 *                                .getObjectRequest(request)
 *                                .build();
 *
 *     // Generate the presigned request
 *     PresignedGetObjectRequest presignedGetObjectRequest =
 *         presigner.presignGetObject(getObjectPresignRequest);
 *
 *     if (presignedGetObjectRequest.isBrowserExecutable())
 *         System.out.println("The pre-signed request can be executed using a web browser by " +
 *                            "visiting the following URL: " + presignedGetObjectRequest.url());
 *     else
 *         System.out.println("The pre-signed request has an HTTP method, headers or a payload " +
 *                            "that prohibits it from being executed by a web browser. See the S3Presigner " +
 *                            "class-level documentation for an example of how to execute this pre-signed " +
 *                            "request from Java code.");
 * }
 * </pre>
 */
PresignedGetObjectRequest presignGetObject(GetObjectPresignRequest request);