Start off with: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html
That'll allow you to stick to "private" files in S3 by default, but with CloudFront being able to access them (best practice).
Then: https://django-storages.readthedocs.io/en/latest/backends/amazon-S3.html#cloudfront-signed-urls
Links to the right places if you do really want private media files rather than fully public URLs.
Alex Tomkins
npub1p8…f9uv5
2024-11-23 11:30:38 UTC
in reply to nevent1q…7kwk
Author Public Key
npub1p8uunuqktmtf4x8y4zkm0p9k4exte46tdtv5chdztycrk92p6p4q2f9uv5Seen on
wss://relay.momostr.pinkPublished at
2024-11-23 11:30:38 UTCEvent JSON
{
"id": "24f1043a547f68443dd2b42ea8fa6798f2663dc400483538b9f856fa4fb519af",
"pubkey": "09f9c9f0165ed69a98e4a8adb784b6ae4cbcd74b6ad94c5da259303b1541d06a",
"created_at": 1732361438,
"kind": 1,
"tags": [
[
"e",
"3a364ebc3ab27ab5407f4f7d3dd8351ffce1628385b65184081bf507e94d44f4",
"",
"root",
"a39a91945320863e63212c3b4f06a13aa380f33aa231788cf172e6701ba657f4"
],
[
"e",
"0a59bfa1c2d62ce25c580656732f357974ea011f94c415f7ef3057f472db7fb7",
"",
"reply",
"a39a91945320863e63212c3b4f06a13aa380f33aa231788cf172e6701ba657f4"
],
[
"p",
"a39a91945320863e63212c3b4f06a13aa380f33aa231788cf172e6701ba657f4"
],
[
"proxy",
"https://fosstodon.org/@alextomkins/113532039239510802",
"web"
],
[
"proxy",
"https://fosstodon.org/users/alextomkins/statuses/113532039239510802",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://fosstodon.org/users/alextomkins/statuses/113532039239510802",
"pink.momostr"
],
[
"-"
]
],
"content": "Start off with: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html\n\nThat'll allow you to stick to \"private\" files in S3 by default, but with CloudFront being able to access them (best practice).\n\nThen: https://django-storages.readthedocs.io/en/latest/backends/amazon-S3.html#cloudfront-signed-urls\n\nLinks to the right places if you do really want private media files rather than fully public URLs.",
"sig": "edaf862cde2cf1bf7c700e4054f68cfd8d20041de026c9364d2b9f3aa03943aa389fb4f13d4a08d840ccaa66cd83d76ccf09cf7c57aa6231059d297fd51f5d08"
}