How to restrict access to the Amazon S3 API?

Question

Is there a way to create a different credential for accessing the key / secret key for accessing Amazon S3 buckets through the REST API where I can restrict access (read only)?

Answer 1

Yes, you can. The S3 API documentation describes the Authentication and Access Control services available to you. You can set up the bucket so that another Amazon S3 account can read, but not modify items in the bucket.

Answer 2

The recommended way is to use IAM to create a new user, then apply the policy to that user.

Answer 3

Check out the details at http://docs.amazonwebservices.com/AmazonS3/2006-03-01/dev/index.html?UsingAuthAccess.html (follow the link "Using query string authentication") - this is a subdocument to one Greg Added and describes how to create on-the-fly access URLs.

This uses a hashed private key form and allows expiration, so you can provide quick access to files in a bucket without allowing unlimited access to the rest of the S3 repository.

Building a REST URL is pretty complicated, it took me about 3 hours of coding to get everything right, but it's a very efficient access technology.