【第3回】AmazonS3へダイレクトアクセスするアプリケーション実装(6)¶

package org.debugroom.mynavi.sample.aws.s3.app.model;

// omit

public class DirectUploadAuthorization implements Serializable {

    private String objectKey;     // アップロードファイルのオブジェクトキー
    private String acl;           // アップロードしたファイルの公開範囲
    private String uploadUrl;     // POSTメソッドでアクセスするアップロード先のURL
    private String policy;        // POSTポリシードキュメント(Base64エンコードが必要)
    private String securityToken; // 一時的認証情報のセキュリティトークン
    private String date;          // 日時情報(UTCTimezone ISO8601:YYYYMMDD'T'HHMMSS'Z')
    private String algorithm;     // "AWS4-HMAC-SHA256"固定
    private String credential;    // 一時的認証情報やリージョンを含む文字列
    private String signature;     // POSTポリシーに対する署名の16進数表現
    private String fileSizeLimit; // アップロードファイルサイズ上限

}

package org.debugroom.mynavi.sample.aws.s3.app.web.helper;

// omit

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;

import com.amazonaws.auth.policy.Policy;
import com.amazonaws.auth.policy.Statement;
import com.amazonaws.auth.policy.actions.S3Actions;
import com.amazonaws.services.identitymanagement.AmazonIdentityManagementClientBuilder;
import com.amazonaws.services.identitymanagement.model.GetRoleRequest;
import com.amazonaws.services.s3.AmazonS3;
import com.amazonaws.services.s3.model.ObjectMetadata;
import com.amazonaws.services.s3.model.PutObjectRequest;
import com.amazonaws.services.securitytoken.AWSSecurityTokenServiceClientBuilder;
import com.amazonaws.services.securitytoken.model.AssumeRoleRequest;
import com.amazonaws.services.securitytoken.model.Credentials;
import com.fasterxml.jackson.core.JsonProcessingException;
import com.fasterxml.jackson.databind.ObjectMapper;

import org.apache.commons.codec.binary.Base64;
import org.apache.commons.codec.binary.Hex;
import org.joda.time.DateTime;
import org.joda.time.DateTimeZone;

// omit

import org.debugroom.mynavi.sample.aws.s3.app.model.DirectUploadAuthorization;
import org.debugroom.mynavi.sample.aws.s3.app.model.PostPolicy;

@Component
public class S3DirectUploadHelper implements InitializingBean {                 // …(1)

    private static final String RESOURCE_ARN_PREFIX = "arn:aws:s3:::";
    private static final String ALGORITHM = "HmacSHA256";

    @Value("${bucket.name}")                                                    // …(2)
    private String bucketName;
    @Value("${cloud.aws.region.static}")
    private String region;
    @Value("${sts.min.duration.minutes}")
    private int stsMinDurationMinutes;
    @Value("${s3.upload.duration.seconds}")
    private int durationSeconds;
    @Value("${s3.upload.acl}")
    private String accessControlLevel;
    @Value("${s3.upload.limitBytes}")
    private String fileSizeLimit;
    @Value("${s3.upload.role.name}")
    private String roleName;
    @Value("${s3.upload.role.session.name}")
    private String roleSessionName;
    private String roleArn;                                                     // …(3)

    // omit

    public DirectUploadAuthorization createDirectUploadAuthorization(
                String uploadDirectory){                                        // …(4)
        String objectKey = new StringBuilder().append(uploadDirectory).append("/").toString();
        Credentials credentials = getTemporaryCredentials(objectKey);           // …(5)
        DateTime nowUTC = new DateTime(DateTimeZone.UTC);
        String dateString = nowUTC.toString("yyyyMMdd");
        String credentialString = createCredentialString(credentials.getAccessKeyId(),
                dateString, region, "s3");                                      // …(6)
        String securityToken = credentials.getSessionToken();                   // …(7)
        String uploadUrl = createUploadUrl(region);          　　　　　　         // …(8)
        String algorithm = "AWS4-HMAC-SHA256";
        String iso8601dateTime = nowUTC.toString("yyyyMMdd'T'HHmmss'Z'");

        PostPolicy postPolicy = PostPolicy.builder()
                .expiration(nowUTC.plusSeconds(durationSeconds).toString())
                .conditions(new String[][]{
                    {"eq", "$bucket", bucketName},
                    {"starts-with", "$key", objectKey},
                    {"eq", "$acl", accessControlLevel},
                    {"eq", "$x-amz-credential", credentialString},
                    {"eq", "$x-amz-security-token", securityToken},
                    {"eq", "$x-amz-algorithm", algorithm},
                    {"eq", "$x-amz-date", iso8601dateTime},
                    {"content-length-range", "0", fileSizeLimit},
                })
                .build();                                                       // …(9)

        String policyDocument = null;
        try{
            policyDocument = objectMapper.writeValueAsString(postPolicy);       // …(10)
        }catch (JsonProcessingException e){
            e.printStackTrace();
        }

        String base64Policy = Base64.encodeBase64String(
                policyDocument.getBytes(StandardCharsets.UTF_8));               // …(11)

        byte[] signingKey = getSignatureKey(credentials.getSecretAccessKey(),   // …(12)
                dateString, region, "s3");

        String signatureForPolicy = Hex.encodeHexString(calculateHmacSHA256(
                base64Policy, signingKey));                  　　　　　　　　　    // …(13)

        return DirectUploadAuthorization.builder()
                .uploadUrl(uploadUrl)
                .acl(accessControlLevel)
                .date(iso8601dateTime)
                .objectKey(objectKey)
                .securityToken(securityToken)
                .algorithm(algorithm)
                .credential(credentialString)
                .signature(signatureForPolicy)
                .policy(base64Policy)
                .fileSizeLimit(fileSizeLimit)
                .build();                  　　　　　　　　　　　　　　　　　　　　    // …(14)
    }

    private Credentials getTemporaryCredentials(String objectKey){
        String resourceArn = new StringBuilder()
                .append(RESOURCE_ARN_PREFIX)
                .append(bucketName).append("/")
                .append(objectKey).append("*")
                .toString();

        Statement statement = new Statement(Statement.Effect.Allow)
                .withActions(S3Actions.PutObject)
                .withResources(new com.amazonaws.auth.policy.Resource(resourceArn));
        String iamPolicy = new Policy().withStatements(statement).toJson();     // …(15)

        AssumeRoleRequest assumeRoleRequest = new AssumeRoleRequest()
                .withRoleArn(roleArn)
                .withDurationSeconds((int)TimeUnit.MINUTES.toSeconds(stsMinDurationMinutes))
                .withRoleSessionName(roleSessionName)
                .withPolicy(iamPolicy);
        return AWSSecurityTokenServiceClientBuilder.standard().build()
                .assumeRole(assumeRoleRequest).getCredentials();                // …(16)
    }

    private String createCredentialString(String accessKey, String date, String region, String serviceName){
        return new StringBuilder()
                .append(accessKey).append("/")
                .append(date).append("/")
                .append(region).append("/")
                .append(serviceName).append("/aws4_request")
                .toString();                                                    // …(17)
    }

    private String createUploadUrl(String region){
        return new StringBuilder()
                .append("https://").append(bucketName).append(".s3-").append(region).append(".amazonaws.com/")
                .toString();                  　　　　　　　　　　　　　　　　　      // …(18)
    }

    private byte[] getSignatureKey(String key, String dateStamp, String region,
                                   String serviceName){
        byte[] kSecret = new StringBuilder().append("AWS4").append(key).toString()
                .getBytes(StandardCharsets.UTF_8);
        byte[] kDate = calculateHmacSHA256(dateStamp, kSecret);
        byte[] kRegion = calculateHmacSHA256(region, kDate);
        byte[] kService = calculateHmacSHA256(serviceName, kRegion);
        byte[] kSigning = calculateHmacSHA256("aws4_request", kService);
        return kSigning;                                                        // …(19)
    }

    private byte[] calculateHmacSHA256(String stringToSign, byte[] signingKey){
        Mac mac = null;
        try{
            mac = Mac.getInstance(ALGORITHM);
            mac.init(new SecretKeySpec(signingKey, ALGORITHM));
        }catch (NoSuchAlgorithmException | InvalidKeyException e){
            e.printStackTrace();
        }
        return mac.doFinal(stringToSign.getBytes(StandardCharsets.UTF_8));      // …(20)
    }

    @Override
    public void afterPropertiesSet() throws Exception {
        GetRoleRequest getRoleRequest = new GetRoleRequest().withRoleName(roleName);
        roleArn = AmazonIdentityManagementClientBuilder.standard().build()
                .getRole(getRoleRequest).getRole().getArn();                    // …(21)
    }

}

package org.debugroom.mynavi.sample.aws.s3.app.web;

// omit

@Controller
public class SampleController {

    // omit

    @Autowired
    S3DirectUploadHelper s3DirectUploadHelper;


    @GetMapping("/upload/authorization")
    @ResponseBody
    public ResponseEntity<DirectUploadAuthorization>
            getDirectUploadAuthorization(){
        String fileUploadPath = UUID.randomUUID().toString();
        s3DirectUploadHelper.createDirectory(fileUploadPath);
        return ResponseEntity.status(HttpStatus.OK).body(
                s3DirectUploadHelper.createDirectUploadAuthorization(
                fileUploadPath));
    }

    // omit

}