---
title: Provide your users proper S3 file access without giving them any credential keys
author: Hue Team
type: post
date: 2021-04-23T00:00:00+00:00
url: /blog/2021-04-23-s3-file-access-without-any-credentials-and-signed-urls/
sf_thumbnail_type:
- none
sf_thumbnail_link_type:
- link_to_post
sf_detail_type:
- none
sf_page_title:
- 1
sf_page_title_style:
- standard
sf_no_breadcrumbs:
- 1
sf_page_title_bg:
- none
sf_page_title_text_style:
- light
sf_background_image_size:
- cover
sf_social_sharing:
- 1
sf_related_articles:
- 1
sf_sidebar_config:
- left-sidebar
sf_left_sidebar:
- Sidebar-2
sf_right_sidebar:
- Sidebar-1
sf_caption_position:
- caption-right
sf_remove_promo_bar:
- 1
ampforwp-amp-on-off:
- default
categories:
- Version 4.10
- Development
---
Using AWS S3 Signed URLs to list buckets, keys and manage files.
[SQL querying](https://medium.com/data-querying/interactively-querying-hbase-via-sql-273013e5b3cc) opens up your data and helps users take decisions backed by hard facts. However, what if the data they need is not present already in the Data Warehouse?
In order to provide a more self service experience, they could bring their [own data to query](https://gethue.com/querying-exploring-the-instacart-dataset-part-1-ingesting-the-data/) or join, then export and share the query results files etc.
Here is a real life scenario where signed URLs have been introduced in the [Hue Editor](http://gethue.com/) project.

*Same and consistent File Browsing interface be it for HDFS, S3, ADLS in Hue*
The Hue SQL Editor has been providing transparent access to the Cloud storages since the early days via its [File Browser](https://gethue.com/introducing-s3-support-in-hue/). It is a quite popular app as otherwise giving direct access to the native S3 or ADLS Web UI is clunky and not Cloud agnostic (also the interfaces are not designed for simplicity and non engineers). Moreover, most of the SQL users are used to the HDFS Browser which looks the same.
However, this usually creates some headache to the cluster administrators as the need to provide a set of S3 credential keys to the Hue Server and have them being shared by everyone. Not very safe. Allowing the File Browser to only admin will then restrict the functionality and we get back to square one.
This is when [S3 Signed URLs](https://boto3.amazonaws.com/v1/documentation/api/latest/guide/s3-presigned-urls.html) come into the picture and help fix this cumbersomeness:

*Users interacting with S3 via Hue and a shared credential key (not the best)*

*Users getting individual temporary URLs letting them access any S3 resources (safe and fine grain access possible)*
Those URLs are usually set to expire (e.g. after 5 minutes) and are “signed”, meaning safe to provide publicly to the users as they can’t modify them without rendering them automatically invalid.
Another benefit is that the Hue Web Server does not need to have any S3 credentials. Hue just asks in this example to a [RAZ Server](https://blog.cloudera.com/access-control-for-azure-adls-cloud-object-storage/) to provide the equivalent URLs for the S3 calls a user wants to make.

*Before (on top), we directly use the AWS Python SDK to call and get a list of buckets, we get back Python objects representing a bucket each. After (bottom), we ask for a special URL and perform HTTP requests directly to S3 without additional authentication, and get back XML data.*