آپلود اصلی فایل امن به AWS S3 در Node.js با Express و Multer

$ node -v
#v20.18.1
$ npm -v
#10.8.2

$ aws configure
#AWS Access Key ID [****************H53C]: 
#AWS Secret Access Key [****************1CcY]: 
#Default region name [us-east-1]: 
#Default output format [json]:

$ mkdir node-file-upload-api
$ cd node-file-upload-api
$ npm init -y

$ npm install express aws-sdk multer dotenv uuid

// app.js
// Import the required packages
const express = require('express');
const multer = require('multer');
const AWS = require('aws-sdk');
const { v4: uuidv4 } = require('uuid');

// Load environment variables from a .env file
require('dotenv').config();

// Create an Express application
const app = express();

// Create an S3 instance with the specified region
const s3 = new AWS.S3({ region: process.env.AWS_REGION });

// Configure Multer to save uploaded files to the 'uploads/' directory
const upload = multer({ dest: 'uploads/' });

app.post('/upload', upload.single('file'), (req, res) => {
    // Get the uploaded file from the request
    const file = req.file;
    const fileKey = `${uuidv4()}-${file.originalname}`;

    const s3Params = {
        Bucket: process.env.S3_BUCKET,
        Key: fileKey,
        Body: require('fs').createReadStream(file.path), // Create a readable stream from the uploaded file
        ContentType: file.mimetype
    };

    s3.upload(s3Params, (err, data) => {
        if (err) {
            return res.status(500).send(err);
        }

        // Generate presigned URL
        const presignedUrlParams = {
            Bucket: process.env.S3_BUCKET,
            Key: fileKey,
            Expires: 60 * 60 // URL expiration time in seconds (e.g., 1 hour)
        };

        s3.getSignedUrl('getObject', presignedUrlParams, (err, presignedUrl) => {
            if (err) {
                return res.status(500).send(err);
            }

            res.status(200).send({
                message: 'File uploaded successfully',
                url: data.Location,
                presignedUrl: presignedUrl
            });
        });
    });
});

// Start the server on port 3000
app.listen(3000, () => {
    console.log('Server running on port 3000');
});

AWS_REGION=us-east-1
S3_BUCKET=my-node-app-bucket-382c-c803-a96a-49f1

AWSTemplateFormatVersion: "2010-09-09"

Resources:
  S3Bucket:
    Type: "AWS::S3::Bucket" # Defines an S3 bucket resource
    Properties:
      BucketName: !Sub "my-node-app-bucket-382c-c803-a96a-49f1" # Sets the bucket name
      PublicAccessBlockConfiguration: # Configures public access settings for the bucket
        BlockPublicAcls: true # Blocks public ACLs
        BlockPublicPolicy: false # Allows custom bucket policies
        IgnorePublicAcls: true # Ignores public ACLs
        RestrictPublicBuckets: true # Restricts public bucket access
      VersioningConfiguration:
        Status: Enabled # Enables versioning for the bucket

  S3BucketPolicy:
    Type: "AWS::S3::BucketPolicy" # Defines a bucket policy resource
    Properties:
      Bucket: !Ref S3Bucket # References the S3 bucket created above
      PolicyDocument:
        Version: "2012-10-17" # Specifies the version of the policy language
        Statement:
          - Effect: Allow # Allows the specified actions
            Principal: "*" # Applies to all principals (users)
            Action: "s3:GetObject" # Allows the GetObject action
            Resource: !Sub "${S3Bucket.Arn}/*" # Applies to all objects in the bucket
            Condition:
              Bool:
                aws:SecureTransport: "true" # Requires requests to use HTTPS
          - Effect: Allow # Allows the specified actions
            Principal:
              AWS: !Sub "arn:aws:iam::${AWS::AccountId}:role/MyAppRole" # Allows the IAM role to access the bucket
            Action: "s3:PutObject" # Allows the PutObject action
            Resource: !Sub "${S3Bucket.Arn}/*" # Applies to all objects in the bucket

  MyAppIAMRole:
    Type: AWS::IAM::Role # Defines an IAM Role resource
    Properties:
      RoleName: MyAppRole # Assigns a name to the IAM role
      AssumeRolePolicyDocument:
        Version: "2012-10-17" # Specifies the version of the policy language
        Statement:
          - Effect: Allow # Allows the following action
            Principal:
              Service: "ec2.amazonaws.com" # Specifies that the EC2 service can assume this role
            Action: "sts:AssumeRole" # Allows EC2 instances to assume the role
      Policies:
        - PolicyName: S3AccessPolicy # Names the inline policy for the role
          PolicyDocument:
            Version: "2012-10-17" # Specifies the version of the policy language
            Statement:
              - Effect: Allow # Allows the following actions
                Action: "s3:PutObject" # Grants permission to upload objects to S3
                Resource: !Sub "${S3Bucket.Arn}/*" # Applies to all objects in the specified S3 bucket

$ aws cloudformation deploy --template-file s3-file-upload.yml --stack-name S3FileUploadStack --capabilities CAPABILITY_NAMED_IAM
#Waiting for changeset to be created..
#Waiting for stack create/update to complete
#Successfully created/updated stack - S3FileUploadStack

$ node app.js
#Server running on port 3000

$ curl -F "file=@/tmp/files/test-upload.png" http://localhost:3000/upload

{
    "message": "File uploaded successfully",
    "url": "https://my-node-app-bucket-382c-c803-a96a-49f1.s3.amazonaws.com/87587526-e70b-451d-a405-ceab366016a8-test-upload.png",
    "presignedUrl": "https://my-node-app-bucket-382c-c803-a96a-49f1.s3.amazonaws.com/87587526-e70b-451d-a405-ceab366016a8-test-upload.png?AWSAccessKeyId=AKIATA6LX4GWXV6MH53C&Expires=1736370100&Signature=66dKUQRW%2F47La3MPPngITEhFE%2FA%3D"
}