Browse Source

[blog] Align image legends on the new line

Romain Rigaux 4 years ago
parent
commit
b70c5d773b

+ 20 - 9
docs/gethue/content/en/posts/2021-04-23-s3-file-access-without-any-credentials-and-signed-urls.md

@@ -52,7 +52,9 @@ In order to provide a more self service experience, they could bring their [own
 
 Here is a real life scenario where signed URLs have been introduced in the [Hue Editor](http://gethue.com/) project.
 
-![Same and consistent File Browsing interface be it for HDFS, S3, ADLS in Hue](https://cdn-images-1.medium.com/max/2572/1*BMrZbQFTCBM8Ad9eZykaKA.png)*Same and consistent File Browsing interface be it for HDFS, S3, ADLS in Hue*
+![Same and consistent File Browsing interface be it for HDFS, S3, ADLS in Hue](https://cdn-images-1.medium.com/max/2572/1*BMrZbQFTCBM8Ad9eZykaKA.png)
+<br>
+*Same and consistent File Browsing interface be it for HDFS, S3, ADLS in Hue*
 
 The Hue SQL Editor has been providing transparent access to the Cloud storages since the early days via its [File Browser](https://gethue.com/introducing-s3-support-in-hue/). It is a quite popular app as otherwise giving direct access to the native S3 or ADLS Web UI is clunky and not Cloud agnostic (also the interfaces are not designed for simplicity and non engineers). Moreover, most of the SQL users are used to the HDFS Browser which looks the same.
 
@@ -60,19 +62,31 @@ However, this usually creates some headache to the cluster administrators as the
 
 This is when [S3 Signed URLs](https://boto3.amazonaws.com/v1/documentation/api/latest/guide/s3-presigned-urls.html) come into the picture and help fix this cumbersomeness:
 
-![Users interacting with S3 via Hue and a shared credential key (not the best)](https://cdn-images-1.medium.com/max/2000/1*l0x18bjmRAOFJBEP_QfEtw.png)*Users interacting with S3 via Hue and a shared credential key (not the best)*
+![Users interacting with S3 via Hue and a shared credential key (not the best)](https://cdn-images-1.medium.com/max/2000/1*l0x18bjmRAOFJBEP_QfEtw.png)
+<br>
+*Users interacting with S3 via Hue and a shared credential key (not the best)*
 
-![Users getting individual temporary URLs letting them access any S3 resources (safe and fine grain access possible)](https://cdn-images-1.medium.com/max/2000/1*hqkJ2QR1SdLf4Af0Z4ABHw.png)*Users getting individual temporary URLs letting them access any S3 resources (safe and fine grain access possible)*
 
+![Users getting individual temporary URLs letting them access any S3 resources (safe and fine grain access possible)](https://cdn-images-1.medium.com/max/2000/1*hqkJ2QR1SdLf4Af0Z4ABHw.png)
+<br>
+*Users getting individual temporary URLs letting them access any S3 resources (safe and fine grain access possible)*
+
+<br><br>
 Those URLs are usually set to expire (e.g. after 5 minutes) and are “signed”, meaning safe to provide publicly to the users as they can’t modify them without rendering them automatically invalid.
 
 Another benefit is that the Hue Web Server does not need to have any S3 credentials. Hue just asks in this example to a [RAZ Server](https://blog.cloudera.com/access-control-for-azure-adls-cloud-object-storage/) to provide the equivalent URLs for the S3 calls a user wants to make.
 
-![Before (on top), we directly use the AWS Python SDK to call and get a list of buckets, we get back Python objects representing a bucket each. After (bottom), we ask for a special URL and perform HTTP requests directly to S3 without additional authentication, and get back XML data.](https://cdn-images-1.medium.com/max/2000/1*hXFR_nN5biT1aawJfTVqew.png)*Before (on top), we directly use the AWS Python SDK to call and get a list of buckets, we get back Python objects representing a bucket each. After (bottom), we ask for a special URL and perform HTTP requests directly to S3 without additional authentication, and get back XML data.*
+![Before (on top), we directly use the AWS Python SDK to call and get a list of buckets, we get back Python objects representing a bucket each. After (bottom), we ask for a special URL and perform HTTP requests directly to S3 without additional authentication, and get back XML data.](https://cdn-images-1.medium.com/max/2000/1*hXFR_nN5biT1aawJfTVqew.png)
+<br>
+*Before (on top), we directly use the AWS Python SDK to call and get a list of buckets, we get back Python objects representing a bucket each. After (bottom), we ask for a special URL and perform HTTP requests directly to S3 without additional authentication, and get back XML data.*
+
+<hr>
 
 This section describes the internal implementation and targets more developers.
 
-![Native (Boto) and URL Signed (RAZ) access path in finer details. Most important is to see that the Boto S3 classes need to be overriden to ask or generate a signed URL and do an HTTP call with them instead of getting it all done by the Boto library. There is no more S3 credendials keys and the S3 Connection object is never used (even set to None to guarantee it).](https://cdn-images-1.medium.com/max/3000/1*C8dNjZ_iC3Lk7TMsF2Oy3w.png)*Native (Boto) and URL Signed (RAZ) access path in finer details. Most important is to see that the Boto S3 classes need to be overriden to ask or generate a signed URL and do an HTTP call with them instead of getting it all done by the Boto library. There is no more S3 credendials keys and the S3 Connection object is never used (even set to None to guarantee it).*
+![Native (Boto) and URL Signed (RAZ) access path in finer details. Most important is to see that the Boto S3 classes need to be overriden to ask or generate a signed URL and do an HTTP call with them instead of getting it all done by the Boto library. There is no more S3 credendials keys and the S3 Connection object is never used (even set to None to guarantee it).](https://cdn-images-1.medium.com/max/3000/1*C8dNjZ_iC3Lk7TMsF2Oy3w.png)
+<br>
+*Native (Boto) and URL Signed (RAZ) access path in finer details. Most important is to see that the Boto S3 classes need to be overriden to ask or generate a signed URL and do an HTTP call with them instead of getting it all done by the Boto library. There is no more S3 credendials keys and the S3 Connection object is never used (even set to None to guarantee it).*
 
 One of the magic piece is the RAZ server, which can convert a S3 call into a signed URL. RAZ is also leveraging [Apache Ranger](https://ranger.apache.org/) which provides authorization and fine grain permissions (i.e. who can access this bucket? who can upload a file in this directory?)
 
@@ -81,7 +95,6 @@ RAZ is not open source, but the underlying logic of the URL generation is simila
 Here are some snippets of code demoing how a call like ‘list buckets’ can be replaced by a Signed S3 URL:
 
 * Boto3: [create_presigned_url()](https://boto3.amazonaws.com/v1/documentation/api/latest/guide/s3-presigned-urls.html)
-
 * Boto2: [generate_url()](http://boto.cloudhackers.com/en/latest/ref/s3.html#boto.s3.connection.S3Connection.generate_url), e.g. connection.generate_url(3600, ‘GET’)
 
 And then how to call it and unmarshal back the XML to Python objects:
@@ -97,7 +110,6 @@ And then how to call it and unmarshal back the XML to Python objects:
 
     response = requests.get(tmp_url)
 
-    print('get_bucket')
     print(response)
 
     rs = ResultSet([('Bucket', Bucket)])
@@ -109,8 +121,7 @@ And then how to call it and unmarshal back the XML to Python objects:
 
 Which will print the same buckets objects as if we were using native Boto:
 
-    > get_bucket
-    <Response [200]>
+    > <Response [200]>
     [<Bucket: demo-gethue>, <Bucket: gethue-test>]
 
 ![Big picture: mainly on the left side we see the Hue File System lib, which is generic enough to provide File Browsing for any storage system (HDFS, S3 native, S3 via Signed URLs, ADLS…). On the right, this is about how to build clients that can interact with services that can generate signed URLs for each call](https://cdn-images-1.medium.com/max/3448/1*PZduhj0fHrxw-PVlue8aeA.png)*Big picture: mainly on the left side we see the Hue File System lib, which is generic enough to provide File Browsing for any storage system (HDFS, S3 native, S3 via Signed URLs, ADLS…). On the right, this is about how to build clients that can interact with services that can generate signed URLs for each call*