S3 Presigned Post

[amkomatz]

Hi everyone. I am using Soto with a Vapor 4 API, and I am trying to figure out how to create a presigned POST request for S3. The presigned POST information will then be used by an iOS app to do a multipart file upload.

So my question is simple: (how) can I create a presigned POST request using Soto S3?

For reference, this is what it would be in the JS SDK. I'm looking for an equivalent to this: https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/modules/_aws_sdk_s3_presigned_post.html

Thank you all in advance, and I love this framework!

[adam-fowler]

Hi,
There is a little doc on presigning S3 URLs here and yes you can pre-sign POST requests.

Pre-signing multipart file upload is quite a complex operation as each operation needs output from the previous operation which then affects how they are signed. UploadPart needs the uploadId from the CreateMultipartUpload. CompleteMultipartUpload needs the eTags from the UploadPart operations.

I would recommend you do your CreateMultipartUpload on the server, then create an array of presigned URLs one for each UploadPart, pass them back to the client. For each UploadPart you need to extract the eTag from the response. You should then pass this array of eTags back to the server so it can call CompleteMultipartUpload.

Also if you are writing code where you are dependent on a client to finish a multipart upload I would add a lifecycle config to the s3 bucket that deletes unfinished multipart uploads after a certain period.

[amkomatz]

@adam-fowler I appreciate your answer very much. However, the process you have described for multipart upload isn't the only solution. Other languages frameworks have a function to created a presigned POST, which will return something like this:

{
  "url": "https://s3.amazonaws.com/launchpad",
  "fields": {
    "key": "uploads/ENirEL-xzcazcDjtD-EI0",
    "bucket": "launchpad",
    "X-Amz-Algorithm": "AWS4-HMAC-SHA256",
    "X-Amz-Credential": "AKDSIAIO3EBJDSMZDNVBYYSD6MCA/21254530/us-east-1/s3/aws4_request",
    "X-Amz-Date": "20200530T020436Z",
    "Policy": "eyJleHBpcmFKJgKJHlowNDozNloiLCJjb25kaXRpb25zIjpbWyJjb250ZW50LWxlbmdfsdgrfgDBdLFsic3RhcnRzLXdpdGgiLCIkQ29udGVusdfsdfsdfaW1hZ2UvIl0sWyJlcfsdf4LWFtei1hY2wiLCJwdWJsaWMtcmVhZCJdLFsiZXEiLCIkeC1hbXotbWV0YS11c2VyLWlkIiwiMSJdLFsiZXEiLCIkeC1hbXotbWV0YS1pbWFnZWFibGUtdHlwZSIsImJlZCJdLFsiZXEiLCIkeC1hbXotbWV0YS1pbWFnZWFibGUtaWQiLCIxIl0seyJrZXkiOiJ1cGxvYWRzL28vRU5pckVMLXh6Y2F6Y0RqdEQtRUkwIn0seyJidWNrZXQiOiJzd3Rlc3RidWNrZXQzIn0seyJYLUFtei1BbGdvcml0aG0iOiJBV1M0LUhNQUMtU0hBMjU2In0seyJYLUFtei1DcmVkZW50aWFsIjoiQUtJQUlPM0VCSk1OVkJZWTZNQ0EvMjAyMDA1MzAvdXMtZWFzdC0xL3MzL2F3czRfcmVxdWVzdCJ9LHsiWC1BbXotRGF0ZSI6IjIwMjAwNTMwVDAyMDQzNloifV19",
    "X-Amz-Signature": "fb0f381d8c9176f86g786gc30f5a25e236546723894dgf2cddb347"
  }
}

This would be returned to the client, and the fields would be used in the multipart upload. I know this is possible because I have implemented it in an iOS app with a C# backend. However, I'm not sure if Soto supports this right now.

Again, any help is appreciated. Thank you again for your initial response :)

Here are some resources for reference:
https://blog.rocketinsights.com/uploading-images-to-s3-via-the-browser/
https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/modules/_aws_sdk_s3_presigned_post.html#presignedpost
https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-post-example.html

[adam-fowler]

Ah you are talking about multipart/form-data not standard s3 multipart upload https://docs.aws.amazon.com/AmazonS3/latest/userguide/mpuoverview.html.

You can create a signed POST URL, in the same way you create a PUT or GET signed URL.

let signedURLFuture = try s3.signURL(
    url: URL(string: "https://<my-bucket>.s3.us-east-1.amazonaws.com/<my-object>")!,
    httpMethod: .POST,
    expires: .minutes(15)
)

I don't have any support for building the multipart/form-data though.