conor909
commented
2 years ago I think this is related to this github issue on Amplify Cli repo
Closed conor909 closed 2 years ago
conor909
commented
2 years ago I think this is related to this github issue on Amplify Cli repo
nadetastic
commented
2 years ago Hi @conor909 👋,
When trying to access another users protected object, you need to include their identity id. Under the hood, the identity id is used to determine the location of the protected file since the id is used as part of the key/path when uploading with Storage.put(). If you don't include one, it defaults to the current users identity id, which explains why you get the not found message.
Storage.get(key,{
level: 'protected',
identityId: '<region>:<random_value>'
});https://docs.amplify.aws/lib/storage/upload/q/platform/js/#protected-level
conor909
commented
2 years ago @nadetastic thanks for the explanation!
So is it best practice to save the owners identity ID to the same object we receive the key? Then do a check to see if the current user is an Admin, if so, add the identity ID prop, if not, just use the Key. It feels a bit manual, because Amplify knows who’s signed in, yet we have to save extra props in places to help retrieve the files.
nadetastic
commented
2 years ago @conor909 Not quite sure what you mean by saving the owners identity ID to the object - by default, Amplify will add the owners identity ID to the key/path in the S3 bucket: protected/<identity-id>/object-name.
However, you would need to have the owners identity ID before calling Storage.get (or Storage.list) in order to include it with the request.
nadetastic
commented
2 years ago Following up with you on this, @conor909 do you have any more questions or need additional help?
conor909
commented
2 years ago @nadetastic I guess the answer is that you need the identity ID of the owner to access the file, how you get that ID is up to you.
Before opening, please confirm:
JavaScript Framework
React
Amplify APIs
Storage
Amplify Categories
No response
Environment information
Describe the bug
When a user uploads a file as protected, an Admin cannot access it because aws-amplify adds a prefix of user region and user id to the location in storage, but returns only the filename as the key.
Expected behavior
I'm not sure if this behaviour is intended or not? I would of thought amplify would know the current logged in user and permissions on the object its attempting to download. So it seems burying protected objects in folders that dont match the object Key is counter intuitive.
Reproduction steps
Upload a file as a logged in user with:
Log in as an admin and try to download the file:
Code Snippet
I save the key to an object, but when the Admin goes to download it, it says key not found, I presume because it's searching for
{admin-region}:{admin-identity-id}/filename.pdfinstead of
{owner-region}:{owner-identity-id}/filename.pdfIs it not possible to download the file without having to save the owners identity Id somewhere for the Admin to use? Since I’ve granted access to the bucket to “Admin” Cognito User Group Pool in the cli, and amplify knows it’s an Admin user.
Additional information and screenshots
I've asked this question on StackOverflow but have not had any replies: https://stackoverflow.com/questions/73557587/amplify-storage-api-cannot-access-protected-files-by-group-pool