Comments (11)
I need a CORS-enabled bucket today in order to experiment more with micropip
- https://pyodide.org/en/stable/usage/api/micropip-api.html
from s3-credentials.
CORS policies can look like this:
[
{
"AllowedHeaders": [
"*"
],
"AllowedMethods": [
"GET"
],
"AllowedOrigins": [
"https://simonwillison.net/"
],
"ExposeHeaders": []
}
]
Or this - from https://grrr.tech/posts/2022/cors-s3-bucket/
{
"CORSRules": [
{
"AllowedOrigins": ["*"],
"AllowedHeaders": ["*"],
"AllowedMethods": ["GET", "POST"]
}
]
}
Full documentation here: https://docs.aws.amazon.com/AmazonS3/latest/API/API_CORSRule.html - which lists the following options:
AllowedHeaders
- array of stringsAllowedMethods
- array of strings (required)AllowedOrigins
- array of strings (required)ExposeHeaders
- array of stringsID
- string, optional - "Unique identifier for the rule"MaxAgeSeconds
- integer, optional, "The time in seconds that your browser is to cache the preflight response for the specified resource"
from s3-credentials.
I could do this as a --cors-policy
option to s3-credentials create
, or I could have a separate s3-credentials cors-policy
command which can be run afterwards against a bucket that has been created.
I'm leaning towards that second option because there are a bunch of different options here and it feels like a command would make it easier to express them.
But I could always do s3-credentials create ... --cors-policy path-to-json.json
as well.
from s3-credentials.
Boto documentation: https://boto3.amazonaws.com/v1/documentation/api/latest/guide/s3-example-configuring-buckets.html#set-a-bucket-cors-configuration
# Define the configuration rules
s3 = boto3.client("s3")
s3.put_bucket_cors(Bucket="BUCKET_NAME", CORSConfiguration={
"CORSRules": [
{
"AllowedHeaders": ["Authorization"],
"AllowedMethods": ["GET", "PUT"],
"AllowedOrigins": ["*"],
"ExposeHeaders": ["GET", "PUT"],
"MaxAgeSeconds": 3000,
}
]
})
Though that example looks misleading to me - "ExposeHeaders": ["GET", "PUT"]
seems wrong, that should be a list of header names that can be exposed in the response, not a list of methods.
from s3-credentials.
Filed a PR to fix that documentation example:
from s3-credentials.
Moro boto documentation:
- get_bucket_cors(Bucket=name) - returns
{"CORSRules": [...]}
- delete_bucket_cors(Bucket=name) - deletes ALL of the CORS rules for the bucket in one go
- put_bucket_cors(Bucket=name, CORSConfiguration=[...]) - replaces the existing configuration with new configuration, provided as a list of up to 100 rules
Interesting to note that while the list of CORSRules
would hint that you can add a rule to an existing configuration that's not how these APIs work - you have to provide the FULL list of rules any time you update any of them.
from s3-credentials.
Design for this command:
s3-credentials set-cors-policy mybucket --policy path-to-full-policy.json
# Or to set just a single policy using options
s3-credentials set-cors-policy mybucket --allowed-method GET --allowed-method PUT --expose-header ETag
# And to delete all of the policies
s3-credentials set-cors-policy mybucket --clear
from s3-credentials.
If you don't provide a --allowed-origin
it will default to ["*"]
.
from s3-credentials.
I ran my prototype:
s3-credentials set-cors-policy simonwillison-cors-allowed
I added a s3-credentials get-cors-policy
command too, mainly so I could see if the change had been recorded:
% s3-credentials get-cors-policy simonwillison-cors-allowed
[
{
"ID": "set-by-s3-credentials",
"AllowedMethods": [
"GET"
],
"AllowedOrigins": [
"*"
]
}
]
from s3-credentials.
Forgot to make the bucket public. Trying this instead:
% s3-credentials create simonwillison-cors-allowed-public --public --create-bucket
Created bucket: simonwillison-cors-allowed-public
Attached bucket policy allowing public access
Created user: 's3.read-write.simonwillison-cors-allowed-public' with permissions boundary: 'arn:aws:iam::aws:policy/AmazonS3FullAccess'
Attached policy s3.read-write.simonwillison-cors-allowed-public to user s3.read-write.simonwillison-cors-allowed-public
Created access key for user: s3.read-write.simonwillison-cors-allowed-public
{
"UserName": "s3.read-write.simonwillison-cors-allowed-public",
"AccessKeyId": "AKIAWXFXAIOZDHIP6CVN",
"Status": "Active",
"SecretAccessKey": "...",
"CreateDate": "2022-05-01 19:59:09+00:00"
}
% s3-credentials set-cors-policy simonwillison-cors-allowed-public
% s3-credentials get-cors-policy simonwillison-cors-allowed-public
[
{
"ID": "set-by-s3-credentials",
"AllowedMethods": [
"GET"
],
"AllowedOrigins": [
"*"
]
}
]
% s3-credentials put-object simonwillison-cors-allowed-public click_default_group-1.2.2-py3-none-any.whl /tmp/click-default-group/dist/click_default_group-1.2.2-py3-none-any.whl
from s3-credentials.
https://s3.amazonaws.com/simonwillison-cors-allowed-public/click_default_group-1.2.2-py3-none-any.whl is now a file I can download.
It looks like that is setting the right CORS headers, provided you send an Origin:
header:
~ % curl -i 'https://s3.amazonaws.com/simonwillison-cors-allowed-public/click_default_group-1.2.2-py3-none-any.whl' -H "Origin: http://www.example.com/"
HTTP/1.1 200 OK
x-amz-id-2: rx1LP6nXSxXBw/ZRyJhbzFEPnOziNZEYy1lYGytqjfdxlEzW62cgGzeEQWi4vG8dpTi6I3iRlFc=
x-amz-request-id: EXVJQX06ZF0EX4VW
Date: Sun, 01 May 2022 20:03:30 GMT
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET
Vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
from s3-credentials.
Related Issues (20)
- Way to make an existing bucket public or private HOT 1
- Convert README into documentation website HOT 3
- Make it easier to add extra policy statements HOT 10
- Provide a `--profile` option to allow AWS profile selection HOT 3
- Using --policy should imply --user-permissions-boundary=none HOT 2
- s3-credentials.AmazonS3FullAccess has MaxSessionDuration 3600, should be 12 hours HOT 5
- KeyError if listing bucket with no items returned
- s3-credentials list-buckets --details should show region and website URL, if configured HOT 2
- `s3-credentials get-objects` command HOT 7
- `get-objects/put-objects` `--skip` and `--skip-hash` options HOT 1
- Add the options to add tags to the created resources HOT 3
- `set-public-policy` command HOT 5
- Add s3:PutObjectAcl to write policies HOT 3
- `s3-credentials delete-objects` command HOT 11
- Mysterious test failure in `test_put_objects` HOT 4
- debug-bucket command HOT 3
- Command to make a bucket public HOT 4
- `s3-credentials create name-of-bucket --create-bucket --public` fails with error HOT 4
- `s3-credentials list-bucket --urls` option HOT 1
- CI failures, including ImportError: cannot import name 'mock_s3' from 'moto' HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from s3-credentials.