This book is about how to implement file downloads and uploads in a serverless environment. It focuses on the motivation behind why serverless needs a different approach to files, how best to implement them, and how to make sure the end result is both secure and performant.
Signed URLs in some forms are implemented in every cloud because they are inevitable for a serverless architecture. In the case of AWS, S3 and CloudFront both implement them with different characteristics and intended use-cases.
When I started researching this topic I quickly realized that it is a surprisingly deep topic. Not only there are multiple ways to implement the same functionality, but also many small details affect whether a given solution is good or not.
URL signing is about access control, i.e. when a component decides whether an actor should have access to some resource. In most of the examples, that boils down to a backend deciding whether a user should have access to a file, such as a visitor should be able to download a digital product or an image.
Access control is part of the overall security of an application and as such, mistakes are not readily apparent. You can see when a download start after clicking a link, but how can you be sure that it won't download when it's not supposed to be? A bogus implementation behaves just like a secure one, except a competent attacker could easily break it.
That's why security is an overarching theme in this book and we'll discuss why the implementations you see here are secure or what are their potential problems.
First, we'll start with some background in The case for signed URLs chapter of how signed URLs works and when they are needed.
The main part of the book is a dual implementation of an ecommerce site. Here, we'll first take a detailed look at how a server-based solution handles files. This will be our baseline for the next part. Then we'll implement the same functionality but in a serverless environment. In these chapters we'll focus on the security of the implementations.
Then the Designing for performance chapter, we'll focus on speed, caching, and latency. We'll implement a photo-sharing app in two ways: first with S3, then with CloudFront signed URLs. We'll discuss how to think about files that are downloaded many times.
After the example apps, we'll look into specific topics in the Diving deep chapter. These are shorter and more focused discussions on various features.
Most of the chapters have end-to-end code examples that you can download and deploy to your own AWS account. These provide an excellent way to experiment with the content of this book: you can see a working implementation, debug it, and also see the effect of various changes.
The code examples are built on Terraform and many chapters feature snippets of Terraform code. If you don't know or never used it, don't worry: a signed URL implementation does not depend on it and the same concepts work with other tools. The main reason behind using Terraform is to provide a reproducible way to deploy the code examples.
If you've never worked with Terraform, here are a few pointers to help with installing and configuring it:
In the code examples you'll find instructions on how to deploy the repository. This is usually an init (terraform init) followed by an apply (terraform apply). After you're done don't forget to clean up the resources (terraform destroy) as some of them have ongoing costs associated.
Resources in AWS costs money. Don't forget the remove the examples when you are done.