如何让SaaS客户仅访问自身AWS S3对象且支持直接通过S3公网URL访问？

Hey there! Let's walk through how to solve your SaaS multi-tenant S3 access requirements—starting with your preferred direct public URL approach, then covering the private bucket + custom server alternative.

This approach lets your customers access S3 objects directly via public URLs while ensuring strict tenant isolation. Here's how to implement it:

1. Establish a Tenant-First Bucket Structure #

Organize your S3 bucket with a clear prefix for each tenant, like:

• s3://your-saas-bucket/tenant-123/document.pdf
• s3://your-saas-bucket/tenant-456/image.png

This creates a logical boundary between tenants' resources and simplifies permission checks.

2. Use Pre-Signed URLs for Controlled Access #

Instead of making objects publicly accessible, generate pre-signed URLs on demand. These are temporary, time-limited URLs that grant access to a specific object only to the authorized tenant.

Example: Generate Pre-Signed URL with Boto3 (Python) #

import boto3
from botocore.exceptions import ClientError

def generate_tenant_s3_url(bucket_name, tenant_id, object_key, expiration=3600):
    # First, validate that the requesting user belongs to tenant_id
    # Add your auth/validation logic here (e.g., check JWT claims)
    
    # Ensure the object key is scoped to the tenant
    full_object_key = f"{tenant_id}/{object_key}"
    
    s3_client = boto3.client('s3')
    try:
        return s3_client.generate_presigned_url(
            'get_object',
            Params={'Bucket': bucket_name, 'Key': full_object_key},
            ExpiresIn=expiration  # URL expires after 1 hour by default
        )
    except ClientError as e:
        print(f"Error generating URL: {e}")
        return None

How It Works: #

1. A tenant requests a resource through your SaaS frontend.
2. Your backend validates the tenant's identity and confirms they own the requested object (via the tenant ID prefix).
3. Your backend generates a pre-signed URL and returns it to the frontend.
4. The tenant's browser uses this URL to access the S3 object directly.

3. Lock Down Permissions with Bucket Policies & IAM #

Add guardrails to prevent unauthorized access to your bucket:

Sample Bucket Policy #

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::YOUR_AWS_ACCOUNT_ID:role/your-saas-backend-role"
            },
            "Action": ["s3:GetObject", "s3:PutObject"],
            "Resource": "arn:aws:s3:::your-saas-bucket/tenant-*/*"
        },
        {
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::your-saas-bucket/*",
            "Condition": {
                "StringNotLike": {
                    "aws:PrincipalArn": "arn:aws:iam::YOUR_AWS_ACCOUNT_ID:role/your-saas-backend-role"
                }
            }
        }
    ]
}

This policy:

• Allows your SaaS backend's IAM role to access all tenant objects.
• Denies all other entities (including public users) from interacting with the bucket.

If you need full control over file delivery (e.g., added logging, custom encryption), you can keep your S3 bucket private and proxy files through your own server.

1. Configure a Private S3 Bucket #

Set your bucket to block all public access (via the S3 console or bucket policy). No objects will be accessible directly from the internet.

2. Proxy Files Through Your Server #

Your backend handles all file requests:

1. Tenant requests a file via your SaaS frontend.
2. Your backend validates the tenant's identity and resource ownership.
3. Your backend fetches the object from S3.
4. Your backend streams the file content to the tenant's browser.

Example: Flask Server Proxy #

from flask import Flask, send_file, abort
import boto3
from io import BytesIO

app = Flask(__name__)
s3_client = boto3.client('s3')
PRIVATE_BUCKET_NAME = "your-private-saas-bucket"

@app.route('/files/<tenant_id>/<object_key>')
def serve_file(tenant_id, object_key):
    # Validate tenant identity (e.g., check session or JWT)
    # ... your auth logic ...
    
    full_key = f"{tenant_id}/{object_key}"
    try:
        s3_response = s3_client.get_object(Bucket=PRIVATE_BUCKET_NAME, Key=full_key)
        file_stream = BytesIO(s3_response['Body'].read())
        return send_file(
            file_stream,
            download_name=object_key.split('/')[-1],
            mimetype=s3_response['ContentType']
        )
    except ClientError as e:
        if e.response['Error']['Code'] == 'NoSuchKey':
            abort(404, description="File not found")
        else:
            abort(500, description="Server error")

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=8080)

Pros & Cons #

• Pros: Full control over file delivery, easy to add custom logging/security layers.
• Cons: Your server bears bandwidth and processing costs, potential for higher latency compared to direct S3 access.

• Strict Tenant Validation: Never trust frontend input—always verify tenant identity and resource ownership on the backend.
• Shorten Pre-Signed URL Expiry: Use shorter expiration times (e.g., 15-30 minutes) to reduce abuse risk.
• Enable Logging: Turn on S3 access logs and CloudWatch monitoring to track access patterns and detect anomalies.
• Encrypt Data: Use S3 server-side encryption (SSE-S3 or SSE-KMS) for at-rest data, and enforce HTTPS for all transfers.

内容的提问来源于stack exchange，提问作者T. M.