s3-request-presigner GetObjectCommand expects key to be decoded uri

[cmcclung-ANGENG]

Checkboxes for prior research

• I've gone through Developer Guide and API reference
• I've checked AWS Forums and StackOverflow.
• I've searched for previous similar issues and didn't find any solution.

Describe the bug

I've come across an incompatiblity between the key format of an S3Event from a trigger and the expected format s3-request-presigner GetObjectCommand expects the key to be in.

For example, If part of the key contains 'eu-west-1:77' (from a creation event)

Then the key is in the encoded format west-1%3A7 as expected.

But If I then use it like so:

 const s3command = new GetObjectCommand({Bucket: record.s3.bucket.name, Key:  record.s3.object.key});
 const url = await getSignedUrl(s3Client, s3command, {expiresIn: 86400});

The presigned uri comes out like:
west-1%253A

So what's happened is that the % has now been escaped (%25) and the %3A (:) has now been corrupted.

I suspect the code should detect if the key is encoded and then run (decode|encode)URIComponent as appriopiate.

Regression Issue

• Select this option if this issue appears to be a regression.

SDK version number

@aws-sdk/[email protected]

Which JavaScript Runtime is this issue in?

Node.js

Details of the browser/Node.js/ReactNative version

Amplify gen 2 6.6.4, Lambda - nodejs:18.v45

Reproduction Steps

1. Create an S3 bucket and access pattern in Amplify gen 2 using {entity_id} (contains a ':' char)
2. Add An S3 trigger on upload.
3. In the lambda use S3Event for:

const s3command = new GetObjectCommand({Bucket: record.s3.bucket.name, Key: record.s3.object.key});
const url = await getSignedUrl(s3Client, s3command, {expiresIn: 86400})

Observed Behavior

The url produced is invalid
The {entity_id} key part contains a ':' which is in the S3Event s3.object.key correctly encoded

But it turns out like %253A - ie % gets escaped and the escaped : part gets corrupted.

This then presents itself as a key not found error.

Expected Behavior

I expect the GetObjectCommand to accept both decoded and encoded keys.

Possible Solution

I suspect the code should detect if the key is encoded and then run (decode|encode)URIComponent as appriopiate.

Additional Information/Context

No response

[aBurmeseDev]

Hi @cmcclung-ANGENG - thanks for reaching out.

Can you try decodeURIComponent for Key value?

const s3command = new GetObjectCommand({
  Bucket: record.s3.bucket.name,
  Key: decodeURIComponent(record.s3.object.key)
});
const url = await getSignedUrl(s3Client, s3command, { expiresIn: 86400 });

[cmcclung-ANGENG]

Hi,

yeah, thats what I did. That works well.