Experimenting With The Amazon Simple Storage Service (S3) API Using ColdFusion

<!---
	Creates a structure with the secretKey and accessID so that I
	don't have to have them in the blog post.
--->
<cfinclude template="credentials.cfm" />

<!---
	This is the file we are going to upload. We need to read in the
	binary file since we aren't posting it like a form field - we're
	posting it as the BODY of the PUT request.
--->
<cfset content = fileReadBinary( expandPath( "./helena.jpg" ) ) />

<!---
	When uploading the file, we are going to save it at the
	following "Key". NOTE: S3 is NOT A FILE SYSTEM. It's a key/value
	store. While this resource address looks like a file path, it is
	a single key.
--->
<cfset resource = "/testing.bennadel.com/signed-urls/helena.jpg" />


<!--- ----------------------------------------------------- --->
<!--- ----------------------------------------------------- --->


<!---
	All requests to the S3 API have to be authenticated. Here, we are
	going to create the "signature" to be used in the Authorization
	header of the PUT request.
--->

<!---
	A timestamp is required for all authenticated requests (NOTE: This
	does not apply to query-string-authentication based requests).
--->
<cfset currentTime = getHttpTimeString( now() ) />

<!---
	The content type is not required; but it will be stored as meta-
	data with the object if supplied.
--->
<cfset contentType = "image/jpeg" />

<!---
	Set up the part of the string to sign - we are not including any
	X-AMZ headers in this.
--->
<cfset stringToSignParts = [
	"PUT",
	"",
	contentType,
	currentTime,
	resource
] />

<!--- Collapse the parts into a newline-delimited list. --->
<cfset stringToSign = arrayToList( stringToSignParts, chr( 10 ) ) />

<!---
	The target string is then signed to Hmac-Sha1 hashing, and
	must be encoded as Base64. For this, I am using my Crypto.cfc
	component.

	NOTE: If you have ColdFusion 10, the hmac() function will now
	do this with a single function call.
--->
<cfset signature = new Crypto().hmacSha1(
	aws.secretKey,
	stringToSign,
	"base64"
) />


<!--- ----------------------------------------------------- --->
<!--- ----------------------------------------------------- --->


<!---
	Post the actual binary to the S3 bucket at the given resouce.
	NOTE: Since we have not provided any ACL (Access Control List)
	permissions, the resource will be stored as *private* by default.
--->
<cfhttp
	result="put"
	method="put"
	url="https://s3.amazonaws.com#resource#">

	<cfhttpparam
		type="header"
		name="Authorization"
		value="AWS #aws.accessID#:#signature#"
		/>

	<cfhttpparam
		type="header"
		name="Content-Length"
		value="#arrayLen( content )#"
		/>

	<cfhttpparam
		type="header"
		name="Content-Type"
		value="#contentType#"
		/>

	<cfhttpparam
		type="header"
		name="Date"
		value="#currentTime#"
		/>

	<cfhttpparam
		type="body"
		value="#content#"
		/>

</cfhttp>


<!--- Dump out the Amazon S3 response. --->
<cfdump
	var="#put#"
	label="S3 Response"
	/>

<!---
	Creates a structure with the secretKey and accessID so that I
	don't have to have them in the blog post.
--->
<cfinclude template="credentials.cfm" />

<!--- This is the resource that we want to read as a binary. --->
<cfset resource = "/testing.bennadel.com/signed-urls/helena.jpg" />


<!--- ----------------------------------------------------- --->
<!--- ----------------------------------------------------- --->


<!---
	All requests to the S3 API have to be authenticated. Here, we are
	going to create the "signature" to be used in the Authorization
	header of the GET request.
--->

<!---
	A timestamp is required for all authenticated requests (NOTE: This
	does not apply to query-string-authentication based requests).
--->
<cfset currentTime = getHttpTimeString( now() ) />

<!--- Set up the part of the string to sign. --->
<cfset stringToSignParts = [
	"GET",
	"",
	"",
	currentTime,
	resource
] />

<!--- Collapse the parts into a newline-delimited list. --->
<cfset stringToSign = arrayToList( stringToSignParts, chr( 10 ) ) />

<!---
	The target string is then signed to Hmac-Sha1 hashing, and
	must be encoded as Base64. For this, I am using my Crypto.cfc
	component.

	NOTE: If you have ColdFusion 10, the hmac() function will now
	do this with a single function call.
--->
<cfset signature = new Crypto().hmacSha1(
	aws.secretKey,
	stringToSign,
	"base64"
) />


<!--- ----------------------------------------------------- --->
<!--- ----------------------------------------------------- --->


<!--- Read the S3 resource AS A BINARY object. --->
<cfhttp
	result="get"
	method="get"
	url="https://s3.amazonaws.com#resource#"
	getasbinary="yes">

	<cfhttpparam
		type="header"
		name="Authorization"
		value="AWS #aws.accessID#:#signature#"
		/>

	<cfhttpparam
		type="header"
		name="Date"
		value="#currentTime#"
		/>

</cfhttp>


<!---
	Reset the output buffer and then stream the content to the
	screen as an image.
--->
<cfcontent
	type="image/jpeg"
	variable="#get.fileContent#"
	/>

<!---
	Creates a structure with the secretKey and accessID so that I
	don't have to have them in the blog post.
--->
<cfinclude template="credentials.cfm" />

<!---
	This is the base resource that we want to provide a URL to. Since
	the resource was stored with Private permissions, we'll need to
	create a query-string-authentication URL that will grant people
	access to the resource (for a limited amout of time).
--->
<cfset resource = "/testing.bennadel.com/signed-urls/helena.jpg" />


<!--- ----------------------------------------------------- --->
<!--- ----------------------------------------------------- --->


<!---
	Using Query-String-Authentication is no different than any other
	authenticated request in that a authentication signature still
	needs to be provided. In this case, it will be part of the URL
	that we are generating.
--->

<!---
	The URL will only be valid for a certain amout of time. This
	time will be determined by the number of SECONDS since Epoch.
	For this demo, we'll make the URL available for 10 seconds.
--->
<cfset nowInSeconds = fix( now().getTime() / 1000 ) />

<!--- Add 10 seconds. --->
<cfset expirationInSeconds = ( nowInSeconds + 10 ) />

<!---
	Prepare the parts of the signature - we are going to leave the
	MD5 hash and the content type blank since the GET request won't
	send those.
--->
<cfset stringToSignParts = [
	"GET",
	"",
	"",
	expirationInSeconds,
	resource
] />

<!--- Collapse the parts into a newline-delimited list. --->
<cfset stringToSign = arrayToList( stringToSignParts, chr( 10 ) ) />

<!---
	The target string is then signed to Hmac-Sha1 hashing, and
	must be encoded as Base64. For this, I am using my Crypto.cfc
	component.

	NOTE: If you have ColdFusion 10, the hmac() function will now
	do this with a single function call.
--->
<cfset signature = new Crypto().hmacSha1(
	aws.secretKey,
	stringToSign,
	"base64"
) />

<!---
	Make sure the signature is properly encoded for use in the query
	string of a GET request.
--->
<cfset urlEncodedSignature = urlEncodedFormat( signature ) />


<!--- ----------------------------------------------------- --->
<!--- ----------------------------------------------------- --->


<cfoutput>

	<img src="https://s3.amazonaws.com#resource#?AWSAccessKeyId=#aws.accessID#&Expires=#expirationInSeconds#&Signature=#urlEncodedSignature#" />

</cfoutput>