I'm curious why some apps need API to access to AWS. What's the use case? Surely not to spin up an EC2 instance when the user clicks a button? Save files to S3? I'm not being sarcastic, genuinely curious. And what's the proposed solution suggested by AWS?
It's hard to say without knowing the app, but my first guess would be for storing files in S3 or pushing a message into a SQS queue.
AWS supports temporary access keys, and one of the recommended solutions is to have an API which generates temporary credentials for a specific task that will expire shortly after.
2) Server: "Okay, here's a temporary key good for the next <n> minutes. The file has to be named <blah> and can't be more than <x> MB long" (there are other restrictions you can set, too, IIRC)
3) Client posts the form to S3 including the temporary key as a field.
Comments
I'm curious why some apps need API to access to AWS. What's the use case? Surely not to spin up an EC2 instance when the user clicks a button? Save files to S3? I'm not being sarcastic, genuinely curious. And what's the proposed solution suggested by AWS?
It's hard to say without knowing the app, but my first guess would be for storing files in S3 or pushing a message into a SQS queue.
AWS supports temporary access keys, and one of the recommended solutions is to have an API which generates temporary credentials for a specific task that will expire shortly after.
Edit:
Heres a link http://docs.aws.amazon.com/STS/latest/UsingSTS/CreatingSessi...
Just off the top of my head:
- Store/retrieve state in/from DynamoDB or RDS
- Pull an object from S3
- Send an SNS notification
- Add a message to an SQS queue
- Dispatch email via SES
Save files to S3.
You can do that with signed forms and similar techniques, though. No need to have the key on the client side (and lots of reasons not to).
The flow is roughly this:
1) Client: "Hey, I want to upload a file."
2) Server: "Okay, here's a temporary key good for the next <n> minutes. The file has to be named <blah> and can't be more than <x> MB long" (there are other restrictions you can set, too, IIRC)
3) Client posts the form to S3 including the temporary key as a field.
4) Result.