使用 accesskey 和 secretkey 从 S3 服务器下载安全文件

Question

我正在尝试使用 NSURLSessionDownloadTask 从 S3 服务器下载安全文件，但它返回 403 错误（拒绝访问）。
我的代码：

NSMutableURLRequest *request = [[NSMutableURLRequest alloc] initWithURL:[NSURL URLWithString:@"https://xxx.amazonaws.com/bucket-name/file_name"]];
request.HTTPMethod = @"GET";

[request setValue:@"kAccessKey" forHTTPHeaderField:@"accessKey"];
[request setValue:@"kSecretKey" forHTTPHeaderField:@"secretKey"];

NSURLSessionDownloadTask *downloadPicTask = [[NSURLSession sharedSession] downloadTaskWithRequest:request completionHandler:^(NSURL *location, NSURLResponse *response, NSError *error) {
    UIImage *downloadedImage = [UIImage imageWithData:
                                [NSData dataWithContentsOfURL:location]];
    dispatch_async(dispatch_get_main_queue(), ^{
        weakSelf.imageView.image = downloadedImage;
        [weakSelf.activityIndicator stopAnimating];
    });

}];
[downloadPicTask resume];

编辑

我找到了这段代码：

AWSCognitoCredentialsProvider *credentialsProvider = [[AWSCognitoCredentialsProvider alloc]initWithRegionType:AWSRegionUSWest2 identityId:@"xxxxxxx" identityPoolId:@"xxxxxxxx" logins:nil];
AWSServiceConfiguration *configuration = [[AWSServiceConfiguration alloc]initWithRegion:AWSRegionUSWest2 credentialsProvider:credentialsProvider];

// Construct the NSURL for the download location.
NSString *downloadingFilePath = [NSTemporaryDirectory() stringByAppendingPathComponent:@"sample_img.png"];
NSURL *downloadingFileURL = [NSURL fileURLWithPath:downloadingFilePath];

// Construct the download request.
AWSS3TransferManagerDownloadRequest *downloadRequest = [[AWSS3TransferManagerDownloadRequest alloc]init];
AWSS3TransferManager * transferManager = [AWSS3TransferManager S3TransferManagerForKey:[[configuration credentialsProvider]sessionKey]];

downloadRequest.bucket = @"test-upload-bucket";
downloadRequest.key = @"sample_img.png";
downloadRequest.downloadingFileURL = downloadingFileURL;

[[transferManager download:downloadRequest] continueWithExecutor:[AWSExecutor mainThreadExecutor]
                                                       withBlock:^id(AWSTask *task){
                                                           return nil;
                                                       }];

IdentityId 和 IdentityPoolId 的输入值是多少？

Answer 1

2017 年夏季工作的功能，您可以将图像名称和表格单元格传递给该功能（我正在为某些表格条目下载徽标）。确保修改您的凭证区域、密钥/秘密凭证和存储桶名称。注意：您的凭据不应是 root。创建单独的 IAM 用户/组/策略并仅授权特定资源（存储桶/对象）和特定操作。创建您的密钥和秘密。我这样做是因为我不想使用亚马逊的 cogito 来管理我的用户。但希望我的移动应用程序能够直接安全地访问 S3 资源，而不是通过一些冗余的服务器端脚本。但是，亚马逊建议移动设备，您使用 cogito 并让每个用户使用自己的/临时凭据。警告购买者。

-(void) awsImageLoad:(NSString*)imageFile :(UITableViewCell*)cell  {

NSArray *filepathelements = [imageFile componentsSeparatedByString:@"/"];
if (filepathelements.count == 0) return;

//extract only the name from a possibe folder/folder/imagename
NSString *imageName = [filepathelements objectAtIndex:filepathelements.count-1];

AWSStaticCredentialsProvider *credentialsProvider =
[[AWSStaticCredentialsProvider alloc]
 initWithAccessKey:@"_______________"
 secretKey:@"__________________________________"];

//My credentials exist on the US East 1 region server farm
AWSServiceConfiguration *configuration = [[AWSServiceConfiguration alloc]initWithRegion:AWSRegionUSEast1 credentialsProvider:credentialsProvider];

// Construct the NSURL for the temporary download location.
NSString *downloadingFilePath = [NSTemporaryDirectory() stringByAppendingPathComponent:imageName];

NSURL *downloadingFileURL = [NSURL fileURLWithPath:downloadingFilePath];

// Construct the download request.
AWSS3TransferManagerDownloadRequest *downloadRequest = [AWSS3TransferManagerDownloadRequest new];

// S3 has only a Global Region -- establish our creds configuration
[AWSS3TransferManager registerS3TransferManagerWithConfiguration:configuration forKey:@"GlobalS3TransferManager"];

AWSS3TransferManager * transferManager = [AWSS3TransferManager S3TransferManagerForKey:@"GlobalS3TransferManager"];

downloadRequest.bucket = @"my_bucket_name";
downloadRequest.key = imageFile;
downloadRequest.downloadingFileURL = downloadingFileURL;

[[transferManager download:downloadRequest] continueWithExecutor:[AWSExecutor mainThreadExecutor] withBlock:^id(AWSTask *task){

    if (task.error){
        if ([task.error.domain isEqualToString:AWSS3TransferManagerErrorDomain]) {
            switch (task.error.code) {
                case AWSS3TransferManagerErrorCancelled:
                case AWSS3TransferManagerErrorPaused:
                    break;

                default:
                    NSLog(@"Error: %@", task.error);
                    break;
            }
        } else {
            NSLog(@"Error: %@", task.error);
        }
    }

    if (task.result) {
        // ...this runs on main thread already
        cell.imageView.image = [UIImage imageWithContentsOfFile:downloadingFilePath];
    }
    return nil;
}];
}

Answer 2

所有HTTP请求在发送到AWS服务器之前都需要正确签名，签名过程非常复杂Signature Version 4 Signing Process所以我建议尝试AWS Mobile SDK for iOS v2

Arun_ 显示的示例是一段代码 sn-ps，说明如何使用 transferManager 通过 AWS Mobile SDK for iOS v2 下载文件。

Answer 3

这对我有用：

    AWSStaticCredentialsProvider *credentialsProvider = [[AWSStaticCredentialsProvider alloc]initWithAccessKey:@"AccessKey" secretKey:@"secretKey"];



    AWSServiceConfiguration *configuration = [[AWSServiceConfiguration alloc]initWithRegion:AWSRegionUSWest2 credentialsProvider:credentialsProvider];

    // Construct the NSURL for the download location.
    NSString *downloadingFilePath = [NSTemporaryDirectory() stringByAppendingPathComponent:@"sample_img.png"];
    NSURL *downloadingFileURL = [NSURL fileURLWithPath:downloadingFilePath];

    // Construct the download request.
    AWSS3TransferManagerDownloadRequest *downloadRequest = [AWSS3TransferManagerDownloadRequest new];
   [AWSS3TransferManager registerS3TransferManagerWithConfiguration:configuration forKey:@"USWest2S3TransferManager"];
    AWSS3TransferManager * transferManager = [AWSS3TransferManager S3TransferManagerForKey:@"USWest2S3TransferManager"];
    downloadRequest.bucket = @"test-upload-bucket";
    downloadRequest.key = @"sample_img.png";
    downloadRequest.downloadingFileURL = downloadingFileURL;

    [[transferManager download:downloadRequest] continueWithExecutor:[AWSExecutor mainThreadExecutor]
                                                           withBlock:^id(AWSTask *task){
                                                               return nil;
                                                           }];