# Objects in S3 Bucket

**URL:** <https://discuss.rubyonrails.org/t/objects-in-s3-bucket/73496>\
**Category:** rubyonrails-talk\
**Created:** [February 16, 2019, 4:27am UTC](https://discuss.rubyonrails.org/t/objects-in-s3-bucket/73496 "2019-02-16T04:27:51Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![David\_Merrick](https://avatars.discourse-cdn.com/v4/letter/d/f6c823/32.png) [@David\_Merrick](https://discuss.rubyonrails.org/u/David_Merrick)\
**Post date:** [February 16, 2019, 4:27am UTC](https://discuss.rubyonrails.org/t/objects-in-s3-bucket/73496/1 "2019-02-16T04:27:51Z")

</div>

Is there a way stop logged in users copying and pasting resources in a S3 Bucket to other people?

Eg [https://s3-ap-southeast-1.amazonaws.com/BucketName/Folder/91155-EXP.pdf](https://s3-ap-southeast-1.amazonaws.com/BucketName/Folder/91155-EXP.pdf)

The 91155-EXP.pdf file only people who are logged can see.

I was wanting to know if something like this [Serving private content with signed URLs and signed cookies - Amazon CloudFront](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html) would work

or is there cheaper easier option?

Cheers Dave

---

<div class="post-metadata">

**Author:** ![Rob\_Jonson](https://avatars.discourse-cdn.com/v4/letter/r/85f322/32.png) [@Rob\_Jonson](https://discuss.rubyonrails.org/u/Rob_Jonson)\
**Post date:** [February 16, 2019, 9:41am UTC](https://discuss.rubyonrails.org/t/objects-in-s3-bucket/73496/2 "2019-02-16T09:41:33Z")

</div>

The easiest way to handle this is to deal with the doc through ActiveStorage where you let rails upload it into an amazon s3 bucket.

Active Storage will then generate an indirect link which goes through your app, and returns a signed time-limited AWS link.

You can add logic at the active storage controller to make sure the user is logged in, and if they copy and paste the redirected link - it won’t work for long.

There is some good chat here about how it would be really nice to avoid this complication

[https://github.com/rails/rails/issues/31419](https://github.com/rails/rails/issues/31419)

but it should give you some background info anyway!

Alternatively, you could roll your own - I assume the private content doc you linked is what rails is using under the hood.

---

<div class="post-metadata">

**Author:** ![David\_Merrick](https://avatars.discourse-cdn.com/v4/letter/d/f6c823/32.png) [@David\_Merrick](https://discuss.rubyonrails.org/u/David_Merrick)\
**Post date:** [February 16, 2019, 6:52pm UTC](https://discuss.rubyonrails.org/t/objects-in-s3-bucket/73496/3 "2019-02-16T18:52:35Z")

</div>

Thanks