Skip to content

Configure S3 Signed URL for File Explorer

This section explains how to configure the AWS S3 File Explorer to read, download, and upload files directly from AWS S3 using signed URLs. By default, the File Explorer accesses AWS S3 through Privacera. With S3 signed URL enabled, Privacera checks the access and returns a signed URL for the object, and the web browser uses it to read or upload the object directly from AWS S3.

Note

S3 signed URL for the File Explorer is supported only in PrivaceraCloud. It is not supported in Self Managed or PrivaceraCloud Data Plane deployments.

How It Works

  1. The user opens, downloads, or uploads a file in the File Explorer.
  2. The DataServer checks the access policies for the user and, if access is allowed, returns a signed URL for the file.
  3. The web browser reads or uploads the file directly from AWS S3 using the signed URL.

Note

  • Signed URL is used only for reading, downloading, and uploading files. Listing, deleting, and creating folders continue to go through the DataServer.
  • A signed URL expires after 10 minutes by default. Until then, anyone who has it can access the file, so do not share it.

Prerequisites

Complete the following before S3 signed URL is enabled; once it is enabled, file reads, downloads, and uploads fail on any bucket that is not prepared.

  • Configure dataserver.shared.secret in the S3 application. Refer to Configure Shared Secret. If it is already configured, the same value is used.
  • Configure CORS on each S3 bucket that users access through the File Explorer. Refer to Configure CORS on the S3 Bucket. CORS is configured per bucket, so configure it on any bucket you add later as well.
  • S3 signed URL is not enabled by default. Contact Privacera Support to enable or disable it for your account. It applies to all users and buckets in the account.

Configure CORS on the S3 Bucket

Since the File Explorer is loaded from the PrivaceraCloud domain and the signed URL points to the AWS S3 endpoint, the web browser blocks the request unless the S3 bucket allows it. The CORS configuration is required only for the web browser. It does not grant any additional access to the bucket.

  1. Sign in to the AWS Management Console and open the Amazon S3 console.
  2. Select the bucket, and then select the Permissions tab.
  3. In the Cross-origin resource sharing (CORS) section, select Edit.

  4. Add the following CORS configuration, and then select Save changes.

    JSON
     1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
    [
    {
        "AllowedHeaders": [
            "*"
        ],
        "AllowedMethods": [
            "PUT",
            "GET"
        ],
        "AllowedOrigins": [
            "https://privaceracloud.com"
        ],
        "ExposeHeaders": []
    }
]

    AllowedOrigins must exactly match the origin (scheme and host) shown in the web browser address bar when you use PrivaceraCloud. If your users access PrivaceraCloud through a different host, such as https://www.privaceracloud.com or a PrivateLink endpoint host, add that origin to the list. Do not use *.

    For more information, refer to the AWS documentation on Configuring cross-origin resource sharing (CORS).

Validation

  1. On the Privacera Portal, navigate to Data Inventory → File Explorer, and open a file in a bucket.
  2. If access is denied, navigate to Access Management → Resource Policies, and in the S3 service, create or update a policy that allows your user to read the objects in the bucket. Then open the file again.
  3. Verify that the file content is displayed.
  4. Download the file. The file opens from the AWS S3 endpoint (amazonaws.com), and the URL contains signature query parameters such as X-Amz-Signature.
  5. Navigate to Access Management → Audits and verify that the access is audited as Allowed.

If the file does not open, refer to Troubleshooting.