In this demo system users can generate permanent URLs for files in a bucket. These URLs contain a token that is used to identify the object and to check access.
The tokens are stored in a DynamoDB table along with the object's key. When a permalink is opened with a given token, this table is used to lookup the key and then a 303 redirect is sent back to the client with a signed URL.
This also provides a revoke functionality as deleting a row from a table prevents further use of that URL.
- terraform
- terraform init
- terraform apply
- go to the resulting URL
- terraform destroy
The first table is the list of objects in the bucket. Use the button to generate a new permalink for any of them:
The list of permalinks is in the second table. It offers a link to open the file in a new tab and to revoke the permalink:
The permalink calls to the backend and it specifies the token as part of the path scheme (/link/<token>):
When a permalink is used, the request goes to the backend. It retrieves the DynamoDB item that corresponds to that token, signs a getObject URL and sends back a 303 HTTP redirect:
This construct offers an easy way to revoke permalinks as removing the item from the DynamoDB table invalidates the token. If a permalink is revoken it will return a 404:
The books are from Project Gutenberg.