undefined | Better HN

0 pointsJoshTriplett1y ago0 comments

> Is there any reason you can't enforce that restriction on your side?

I'd like to set IAM permissions for a role, so that that role can add objects to the content-addressible store, but only if their name matches the hash of their content.

> Or are you saying you want S3 to automatically set the name for you based on the hash?

I'm happy to name the files myself, if I can get S3 to enforce that. But sure, if it were easier, I'd be thrilled to have S3 name the files by hash, and/or support retrieving files by hash.

0 comments

mdavidn1y ago

I think you can presign PutObject calls that validate a particular SHA-256 checksum. An API endpoint, e.g. in a Lambda, can effectively enforce this rule. It unfortunately won’t work on multipart uploads except on individual parts.

UltraSane1y ago

The hash of multipart uploads is simply the hash of all the part hashes. I've been able to replicate it.

thayne1y ago

But in order to do that you need to already know the contents of the file.

I suppose you could have some API to request a signed url for a certain hash, but that starts getting complicated, especially if you need support for multi-part uploads, which you probably do.

JoshTriplettOP1y ago

Unfortunately, last I checked, the list of headers you're allowed to enforce for pre-signing does not include the hash.

j / k navigate · click thread line to collapse