bucket restriction does not seem to be working

[gtnbssn]

I have deployed TiTiler using the clickable button on the homepage of this repo.

During the setup phase, I indicated the name of the bucket I wish to restrict our service to: static-content-libmaps.nus.edu.sg

Once deployed, I see I can still use the deployed TiTiler with COGs that are hosted outside of my S3 bucket, for instance https://sentinel-cogs.s3.us-west-2.amazonaws.com/sentinel-s2-l2a-cogs/36/Q/WD/2020/7/S2A_36QWD_20200701_0_L2A/TCI.tif

At the moment this can be tried out here:
https://p3fzuczz5m.execute-api.ap-southeast-1.amazonaws.com/api.html#/Cloud%20Optimized%20GeoTIFF/info_cog_info_get

The generated TiTilerRolePolicy1 reads like this:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "s3:GetObject",
                "s3:HeadObject"
            ],
            "Resource": [
                "arn:aws:s3:::static-content-libmaps.nus.edu.sg/*"
            ],
            "Effect": "Allow"
        }
    ]
}

Following the comments found here, I have changed it to this:

(As mentioned there, the editor does give an error related to s3:HeadObject.)

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::static-content-libmaps.nus.edu.sg/*"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "s3:GetObject"
            ],
            "Resource": [
                "*"
            ],
            "Effect": "Deny"
        }
    ]
}

But I can still use my deployment with a COG that is outside of my bucket.

Any clues?

[vincentsarago]

Hi @gtnbssn,

Sadly if using https:// urls for public dataset, the S3 bucket IAM role won't have any effect.

To really Deny any URL that not fit your needs, you need to use a custom application with a custom PathParam dependency https://github.com/developmentseed/titiler/blob/main/src/titiler/core/titiler/core/dependencies.py#L54-L56

[gtnbssn]

Thanks!

I see. The one click install was so practical, I feel like it might be easier to configure API gateway in such a way that it will have only endpoints for my files, rather than fiddle with the code. Would you recommend this path?

[bo-lu]

Hi Vincent,

I have a similar request as @gtnbssn. Would it be possible to add support so that we can pass 'TITILER_STACK_' variables in the Environment Variable tab for AWS Lambda?

I've tried to download the Lambda layer and make changes, but everything is in python bytecode. Is the only way to fully customize titiler to use the cdk and build a customized solution?

Thanks!

Bo

[vincentsarago]

@bo-lu I'm not quite sure to fully understand what you are asking. TITILER_STACK has no effect in the deployment using the lambda layer and the Serverless application model .

I guess you are referring to https://github.com/developmentseed/titiler/blob/main/deployment/aws/cdk/config.py#L88 which is specific to the CDK application shared in the titiler repo (totally different from this repo)

https://developmentseed.org/titiler/deployment/aws/lambda/

[bo-lu]

Hi Vincent,

Thanks for your reply. I think you've actually answered my question in this:
developmentseed/titiler#412

What I was hoping would be possible was to add bucket restrictions in the Environment Variables like so:

Bo

[vincentsarago]

What I was hoping would be possible was to add bucket restrictions in the Environment Variables like so:

That's something that is not possible at application level but only a deployment level (by editing the AWS IAM Role)

at application level, the validation must be done through a custom dependency as explained in developmentseed/titiler#412