How to transfer files from Amazon S3 to untrusted server via a intermediary

Question

I have two servers that have an encrypted line of communication between them. For one server  I do not trust with any aws credentials so normally it cannot access my files. Is there a way to get a file from S3 to the untrusted server?

I don't want to use CDN or make my files public since I don't want anyone but the two servers to access them.

So any suggestions?

Answer 1

There is one way. If the other services you have is trusted one then You can generate pre-signed URLs on the trusted servers and send those to the untrusted server that can then use those URLs to safely download the file. 

The URLs don't require the untrusted server to hold any keys. They also have a limited time-to-live so you can limit your exposure if those leak for some reason.

This way you can allow the untrusted server to access only the files you want for the period of time you want

Something like

aws s3 presign s3://mybucket/myfile --expires-in 60