保护对象安全

Python 中的 AWS Boto 入门

Maksim Pecherskiy

Data engineer

为何关注权限？

df = pd.read_csv('https://gid-staging.potholes.csv')

权限概览

为何关注权限？

权限已允许！

# Generate the boto3 client for interacting with S3
s3 = boto3.client('s3', region_name='us-east-1', 
                         aws_access_key_id=AWS_KEY_ID, 
                         aws_secret_access_key=AWS_SECRET)

# Use client to download a file
s3.download_file(
  Filename='potholes.csv',
  Bucket='gid-requests', 
  Key='potholes.csv')

AWS 权限体系

IAM

存储桶策略

ACL

预签名 URL

AWS 权限体系

IAM

存储桶策略

ACL

预签名 URL

ACL

上传文件

s3.upload_file(
  Filename='potholes.csv', Bucket='gid-requests', Key='potholes.csv')

将 ACL 设为 'public-read'

s3.put_object_acl(
  Bucket='gid-requests', Key='potholes.csv', ACL='public-read')

上传时设置 ACL

上传时设置 'public-read' ACL

s3.upload_file(
  Bucket='gid-requests', 
  Filename='potholes.csv', 
  Key='potholes.csv', 
  ExtraArgs={'ACL':'public-read'})

访问公共对象

S3 对象 URL 模板

https://{bucket}.{key}

Key='2019/potholes.csv' 的 URL

https://gid-requests.2019/potholes.csv

生成公共对象 URL

生成对象 URL 字符串

url = "https://{}.{}".format(
  "gid-requests", 
  "2019/potholes.csv")

'https://gid-requests.2019/potholes.csv'

# 读取 URL 到 Pandas
df = pd.read_csv(url)

访问如何判定

访问层级

访问如何判定

访问层级

复习

IAM

存储桶策略

ACL

预签名 URL

复习

将 ACL 设为 'public-read'

s3.put_object_acl(
  Bucket='gid-requests', Key='potholes.csv', ACL='public-read')

将 ACL 设为 'private'

s3.put_object_acl(
  Bucket='gid-requests', Key='potholes.csv', ACL='private')

复习

上传时设置 'public-read' ACL

s3.upload_file(
  Bucket='gid-requests', 
  Filename='potholes.csv', 
  Key='potholes2.csv', 
  ExtraArgs={'ACL':'public-read'})

复习

生成对象 URL 字符串

url = "https://{}.{}".format(
  "gid-requests", 
  "2019/potholes.csv")

'https://gid-requests.2019/potholes.csv'

# 读取 URL 到 Pandas
df = pd.read_csv(url)

开始练习！

Python 中的 AWS Boto 入门