An older NestJS service around Amazon S3

An S3 API call and an object’s public accessibility answer different questions. This earlier NestJS experiment wrapped bucket and object operations in a service, then explored the permissions behind the resulting URL.

Historical SDK example. The source used the older aws-sdk package and unpinned setup commands. Its prices, free-tier terms, console screens, and broad AmazonS3FullAccess setup are not retained as current guidance. No AWS resources or credentials were used.

Service and configuration boundaries

The application used Nest configuration, an AWS region, and externally supplied credentials. The original page flattened several setup fragments into single lines, so they are summarized here rather than guessed back into executable source.

$ npm i aws-sdk --save

$ nest g s aws/s3

The S3 service Gist revision wraps listing, creation, uploads, object deletion, and policy operations. Its name-bearing license notice and full module remain in the private source record.

The recorded application calls

import {NestFactory} from '@nestjs/core';import {AppModule} from './app.module';import {S3Service} from "./aws/s3/s3.service";async function bootstrap() {    const app = await NestFactory.create(AppModule);    const s3Service = app.get(S3Service);    const listBuckets = await s3Service.listBuckets();    console.log({listBuckets});}bootstrap();

$ npm start

const bucketName = 'empty-test00001';const createBucket = await s3Service.createBucket(bucketName);console.log({createBucket});

{ createBucket: 'http://empty-test00001.s3.amazonaws.com/' }

const uploadFile = await s3Service.uploadFile(bucketName, './res/nhancv.txt');console.log({uploadFile});

The output belongs to the earlier run. A successful upload does not make the resulting object publicly readable.

Public access is a separate decision

The experiment added this public-read policy:

{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "1583911202112",            "Effect": "Allow",            "Principal": "*",            "Action": "s3:GetObject",            "Resource": "arn:aws:s3:::empty-test00001/*"        }    ]}

const putBucketPolicy = await s3Service.putBucketPolicy(bucketName);console.log({putBucketPolicy});

Principal: "*" opens a broad access boundary. It is preserved as the experiment’s behavior, not a default fix for a private object’s access error.

Deletion has its own scope

const deleteObject = await s3Service.deleteObject(bucketName, 'nhancv.txt');console.log({deleteObject});const deleteBucket = await s3Service.deleteBucket(bucketName);console.log({deleteBucket});

Deleting a named object and bucket is not a complete recovery or versioned-object cleanup strategy. The S3 documentation explains the service’s current access model; the earlier calls were not executed for this revision.

← Back to the garden