s3presignedUrl ( method ; bucket ; region ; theFilePath ; expireSeconds ; accessKey ; secretKey ; optionsObj )

Generate a presigned URL to upload/download/delete an object in S3

Be the first to rate this function Log in to vote

Jason Wood - Show more from this author
Define Database
https://www.definedatabase.com

Sample input:

s3presignedUrl ( "PUT" ; "mybucket" ; "ca-central-1" ; "path/file.jpg" ; 60 ; $accessKey ; $secretKey ; "" )

Sample output:

https://mybucket.s3-ca-central-1.amazonaws.com/path/file.jpg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=abcdefghijklmnopqrstuvwxyz/20251207/ca-central-1/s3/aws4_request&X-Amz-Date=20251207T200028Z&X-Amz-Expires=60&X-Amz-SignedHeaders=host&X-Amz-Signature=5e8fb4554b2c355fc7e259c7c7b4620be46723334115620983234bb8bfef3acb

Function definition: (Copy & paste into FileMaker's Edit Custom Function window)

/*
==================================================================
PURPOSE:
       Get a presigned URL for an object in S3 that is valid for the specified period of time and is safe to make public (ie: does not compromise your secret key)
       
PARAMETERS:
       method | GET or PUT or DELETE
       bucket | the bucket name
       region | eg: ca-central-1
       theFilePath | the full path to the file in the bucket eg: /folder/filename.pdf
       expireSeconds | the length of time that the URL will be valid
       accessKey | AWS Access Key
       secretKey | AWS Secret Key
       optionsObj | empty or JSON object containing optional options

RETURNS:
       (string) Presigned URL

NOTES & DEPENDENCIES:
       Optional options in optionsObj:
       host | the provider's domain, with or without the bucket name. not required for AWS.
       token | the session token (e.g., from AWS STS), if your role requires you to include one.

CONTRIBUTORS
       JW / Jason Wood / Define Database / www.definedatabase.com
       CLC / Cristos Lianides-Chin / Codence / www.codence.com

CHANGELOG
       2021-03-20 JW Created
       2021-03-23 JW Added method parameter
       2021-03-25 JW Added URL encoding of file path
       2021-03-30 JW Added optionsObj parameter to pass optional parameters
       2021-07-23 JW Updated to convert "%2F" to "/" after signing, for compatibility with web viewer in WebDirect
       2021-09-08 JW Added substitutions to account for GetAsURLEncoded() failure to encode some special characters: ' ! ( ) * :
       2022-01-13 JW Modified how third party provider hostnames are handled for better compatibility. You must now pass the full hostname for non-AWS providers.
       2023-06-29 JW Transitioned from S3 dash Region endpoint structure to S3 dot Region endpoint structure to expand support to all AWS regions.
       2024-06-03 CLC Added support for optional `X-Amz-Security-Token` header via `token` in `optionsObj` when using AWS STS session tokens
==================================================================
*/

Let ([

  ~method = Upper ( method ) ;
  ~accessKey = accessKey  ;
  ~secretKey = secretKey ; 
  ~region = region ;
  ~bucket = bucket ;
  ~file = GetAsURLEncoded ( theFilePath ) ; //should start with "/"
  ~file = Substitute ( ~file ; [ "'" ; "%27" ] ; [ "!" ; "%21" ] ; [ "(" ; "%28" ] ; [ ")" ; "%29" ] ; [ "*" ; "%2A" ] ; [ ":" ; "%3A" ] ) ; //strange limitation of GetAsURLEncoded
  ~expireSeconds = expireSeconds ; //up to 604800 (7 days), 86400 is 1 day

  ~optionsObj = If ( Left ( JSONGetElement ( optionsObj ; "xalsdjfaluksdfjlnzvoiysehsz" ) ; 3 ) = "? *" ; "{}" ; optionsObj ) ;
  ~optionsHost = JSONGetElement ( ~optionsObj ; "host" ) ;
  ~optionsToken = GetAsURLEncoded ( JSONGetElement ( ~optionsObj ; "token" ) );

  ~host = If ( IsEmpty ( ~optionsHost ) ; ~bucket & ".s3." & ~region & ".amazonaws.com" ; ~optionsHost ) ;

  ~file = Substitute ( ~file ; "%2F" ; "/" ) ;
  ~file = If ( Left ( ~file ; 1 ) = "/" ; ~file ; "/" & ~file ) ;

  ~timestampfm = GetAsTimestamp ( Int( Get ( CurrentTimeUTCMilliseconds ) / 1000 ) ) ;
  ~date = Year ( ~timestampfm ) & Right( "00" & Month ( ~timestampfm ); 2 ) & Right( "00" & Day ( ~timestampfm ); 2 ) ;
  ~timestamp = ~date & "T" 
          & Right( "00" & Hour ( ~timestampfm ); 2 ) 
          & Right( "00" & Minute ( ~timestampfm ); 2 ) 
          & Right( "00" & Seconds ( ~timestampfm ); 2 ) & "Z" ;

  ~lf = Char(10) ;
  ~query = "X-Amz-Algorithm=AWS4-HMAC-SHA256" 
          & "&X-Amz-Credential=" & ~accessKey & "%2F" & ~date & "%2F" & ~region & "%2F" & "s3" & "%2F" & "aws4_request"
          & "&X-Amz-Date=" & ~timestamp 
          & "&X-Amz-Expires=" & ~expireSeconds 
          & If ( Length ( ~optionsToken ) ; "&X-Amz-Security-Token=" & ~optionsToken ) 
          & "&X-Amz-SignedHeaders=host" ;

  ~canonical_request = ~method & ~lf 
          & ~file & ~lf 
          & ~query & ~lf 
          & "host:" & ~host & ~lf 
          & ~lf 
          & "host" & ~lf 
          & "UNSIGNED-PAYLOAD" ;

  ~canonical_hashed = Lower ( HexEncode ( CryptDigest ( ~canonical_request ; "SHA256" ) ) ) ;

  ~string_to_sign = "AWS4-HMAC-SHA256" & ~lf 
          & ~timestamp & ~lf 
          & ~date & "/" & ~region & "/s3/aws4_request" & ~lf 
          & ~canonical_hashed ;

  ~kDate = CryptAuthCode ( ~date ; "SHA256" ; "AWS4" & ~secretKey ) ;
  ~kRegion = CryptAuthCode ( ~region ; "SHA256" ; ~kDate ) ;
  ~kService = CryptAuthCode ( "s3" ; "SHA256" ; ~kRegion ) ;
  ~kSigning = CryptAuthCode ( "aws4_request" ; "SHA256" ; ~kService ) ;
  ~signature = Lower( HexEncode ( CryptAuthCode ( ~string_to_sign ; "SHA256" ; ~kSigning ) ) );

  ~query = Substitute ( ~query ; ["%2F" ; "/" ]) //must be percent encoded to calculate the signature, but it is more compatible with WebDirect if the URL is converted back to unencoded form.
       

];

"https://" & ~host & ~file & "?" & ~query & "&X-Amz-Signature=" & ~signature

)

FileMaker custom function to generate a presigned URL to upload/download/delete an object in S3

More info: https://github.com/quarfie/s3presignedUrl_FMFunction

PARAMETERS

method | GET or PUT or DELETE or HEAD
bucket | the bucket name
region | eg: ca-central-1
theFilePath | the full path to the file in the bucket eg: /folder/filename.pdf
expireSeconds | the length of time that the URL will be valid
accessKey | AWS Access Key
secretKey | AWS Secret Key
optionsObj | empty or JSON object containing optional parameters

OPTIONAL PARAMETERS

optional parameters are passed as JSON inside the optionsObj parameter

host | the provider's domain, not required for AWS. Must include the full hostname including the bucket name if required.
token | the session token (e.g., from AWS STS), if your role requires you to include one.

USAGE

Generate a presigned URL with the desired method, then...

GET

You can use Insert From URL to download the object to a container or variable (to download a binary object to a variable in FileMaker, you must add the --FM-return-container-variable cURL option). Alternatively, reference the presigned URL in a web viewer (in an src attribute, for example). Note: You may need to change the CORS settings for your bucket in order to load the object into a web viewer.

PUT

Use Insert From URL with the following cURL options:

"-X PUT -H " & Quote ( "Content-Length: " & $fileSizeInBytes ) & " -H " & Quote ( "Content-Type: " & $contentType ) & " --data-binary @$container -D $responseHeaders"

$contentType is the mime type. For example APPLICATION/PDF or IMAGE/PNG. Having the correct content type stored in S3 is necessary to GET the object into a browser or web viewer. For example, without the content-type header IMAGE/PNG, a PNG file would simply by downloaded rather than displayed.

If the upload was successful, PatternCount ( $responseHeaders ; "200 OK" ) will return True.

DELETE

Use Insert From URL with the following cURL options:

"-X DELETE -D $responseHeaders"

If deletion was successful, PatternCount ( $responseHeaders ; "204 No Content" ) will return True.

HEAD

Use Insert From URL with the following cURL options:

--head

The result will include headers that you may wish to parse out, such as Content-Type and Content-Length. Here's one way to extract a header from the result $result:

Let ([
~header = "Content-Type" ;
~start = Position ( $result ; ~header ; 1 ; 1 ) + Length ( ~header ) + 2 ;
~end = Position ( $result ; "¶" ; ~start ; 1 ) ;
~value = Middle ( $result ; ~start ; ~end - ~start )
];
~value
)

Comments

Note: these functions are not guaranteed or supported by BrianDunning.com. Please contact the individual developer with any questions or problems.

s3presignedUrl ( method ; bucket ; region ; theFilePath ; expireSeconds ; accessKey ; secretKey ; optionsObj )

Comments

Support this website.

Support this website.