Object Storage & Presigned URLs

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

package com.example.storage;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import software.amazon.awssdk.auth.credentials.DefaultCredentialsProvider;
import software.amazon.awssdk.regions.Region;
import software.amazon.awssdk.services.s3.S3Client;
import software.amazon.awssdk.services.s3.presigner.S3Presigner;

import java.net.URI;

@Configuration(proxyBeanMethods = false)
public class S3StorageConfig {

    @Bean
    public S3Client s3Client() {
        return S3Client.builder()
            .region(Region.US_EAST_1)
            .credentialsProvider(DefaultCredentialsProvider.create())
            .build();
    }

    @Bean
    public S3Presigner s3Presigner() {
        return S3Presigner.builder()
            .region(Region.US_EAST_1)
            .credentialsProvider(DefaultCredentialsProvider.create())
            .build();
    }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

package com.example.storage;

import org.springframework.stereotype.Service;
import software.amazon.awssdk.services.s3.model.PutObjectRequest;
import software.amazon.awssdk.services.s3.presigner.S3Presigner;
import software.amazon.awssdk.services.s3.presigner.model.PresignedPutObjectRequest;

import java.time.Duration;

@Service
public class PresignedUrlService {

    private final S3Presigner s3Presigner;
    private static final String BUCKET = "enterprise-documents";

    public PresignedUrlService(S3Presigner s3Presigner) {
        this.s3Presigner = s3Presigner;
    }

    public String generateUploadUrl(String documentId, String contentType) {
        PutObjectRequest objectRequest = PutObjectRequest.builder()
            .bucket(BUCKET)
            .key("uploads/" + documentId)
            .contentType(contentType)
            .build();

        // Generate time-limited upload URL valid for 15 minutes
        PresignedPutObjectRequest presigned = s3Presigner.presignPutObject(builder -> builder
            .signatureDuration(Duration.ofMinutes(15))
            .putObjectRequest(objectRequest)
        );

        return presigned.url().toString();
    }
}

1
2
3
4
5
6
7
8
9

# 1. Request presigned URL from Spring Boot
UPLOAD_URL=$(curl -s http://localhost:8080/api/documents/doc-101/upload-url | jq -r .url)

# 2. Upload file directly to S3 using the presigned URL
curl -i -X PUT -T report.pdf -H "Content-Type: application/pdf" "$UPLOAD_URL"
# EXPECTED: HTTP/1.1 200 OK (Uploaded directly to S3 without hitting Spring server!)

# 3. Verify upload expires after 15 minutes
# Attempting upload after expiration returns HTTP 403 Forbidden with RequestExpired