Private Uploads with a Least-Privilege Task Role

1. 1

   The uploads bucket

   Same baseline as the assets bucket, plus: CORS allowing browsers to PUT directly (tighten allowed_origins to your real frontend domain), a lifecycle rule that deletes abandoned multipart uploads, and a bucket policy denying any request without TLS.

   resource "aws_s3_bucket" "uploads" {
     bucket        = "${local.name_prefix}-uploads-${random_id.suffix.hex}"
     force_destroy = var.environment != "prod"
   }
   
   resource "aws_s3_bucket_public_access_block" "uploads" {
     bucket                  = aws_s3_bucket.uploads.id
     block_public_acls       = true
     block_public_policy     = true
     ignore_public_acls      = true
     restrict_public_buckets = true
   }
   
   resource "aws_s3_bucket_cors_configuration" "uploads" {
     bucket = aws_s3_bucket.uploads.id
   
     cors_rule {
       allowed_methods = ["PUT"]
       allowed_origins = ["*"] # tighten to your frontend's origin
       allowed_headers = ["content-type"]
       max_age_seconds = 3000
     }
   }
   
   resource "aws_s3_bucket_lifecycle_configuration" "uploads" {
     bucket = aws_s3_bucket.uploads.id
   
     rule {
       id     = "abort-incomplete-multipart"
       status = "Enabled"
       filter {}
       abort_incomplete_multipart_upload {
         days_after_initiation = 1
       }
     }
   }
   
   data "aws_iam_policy_document" "uploads_bucket" {
     statement {
       sid     = "DenyInsecureTransport"
       effect  = "Deny"
       actions = ["s3:*"]
       resources = [
         aws_s3_bucket.uploads.arn,
         "${aws_s3_bucket.uploads.arn}/*",
       ]
       principals {
         type        = "*"
         identifiers = ["*"]
       }
       condition {
         test     = "Bool"
         variable = "aws:SecureTransport"
         values   = ["false"]
       }
     }
   }
   
   resource "aws_s3_bucket_policy" "uploads" {
     bucket = aws_s3_bucket.uploads.id
     policy = data.aws_iam_policy_document.uploads_bucket.json
   
     # Block Public Access must exist first, or a policy change could briefly be evaluated without it.
     depends_on = [aws_s3_bucket_public_access_block.uploads]
   }

2. 2

   Scope the task role to one prefix

   Extend the task role's policy document with a second statement. Object actions go on <bucket-arn>/uploads/*, not on the bucket ARN and not on *.

   Add a second statement inside data "aws_iam_policy_document" "api_task".

     statement {
       sid       = "UploadsPrefixOnly"
       actions   = ["s3:PutObject", "s3:GetObject"]
       resources = ["${aws_s3_bucket.uploads.arn}/uploads/*"]
     }

3. 3

   Presigned URLs in ShopLite 1.3.0

   npm install @aws-sdk/client-s3 @aws-sdk/s3-request-presigner. The SDK picks up the task role's credentials automatically from the ECS container credentials endpoint, with no keys anywhere. Keys get a random prefix so users can't overwrite each other's files.

   import crypto from "node:crypto";
   import { S3Client, PutObjectCommand } from "@aws-sdk/client-s3";
   import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
   
   const s3 = new S3Client({});
   
   // inside the handler, before the fallback:
     if (req.method === "POST" && req.url === "/uploads") {
       const body = await new Promise((r) => { let d = ""; req.on("data", (c) => (d += c)); req.on("end", () => r(d)); });
       const { filename = "file", contentType = "application/octet-stream" } = JSON.parse(body || "{}");
       const key = `uploads/${crypto.randomUUID()}-${filename.replace(/[^\w.-]/g, "_")}`;
       const url = await getSignedUrl(
         s3,
         new PutObjectCommand({ Bucket: process.env.UPLOADS_BUCKET, Key: key, ContentType: contentType }),
         { expiresIn: 300 },
       );
       return json(res, 201, { key, url });
     }

4. 4

   Tell the container which bucket, then deploy

   Add { name = "UPLOADS_BUCKET", value = aws_s3_bucket.uploads.bucket } to the container's environment, plus an uploads_bucket output. Build and push 1.3.0, set it in tfvars, and apply.

   terminalcopy cmd

   $ docker buildx build --platform linux/arm64 -t "$REPO:1.3.0" --push ../app

   terraform apply

   ── expected output ──

   Plan: 6 to add, 2 to change, 1 to destroy.

   ...

   Apply complete! Resources: 6 added, 2 changed, 1 destroyed.

5. 5

   Upload end to end

   Ask ShopLite for a URL, then PUT a file straight to S3 with it. The Content-Type header must match what was signed. Then confirm the object exists.

   terminalcopy cmd

   $ URL=$(terraform output -raw api_url)

   RESP=$(curl -s -X POST "$URL/uploads" -H 'content-type: application/json' -d '{"filename":"logo.png","contentType":"image/png"}')

   curl -s -o /dev/null -w '%{http_code}\n' -X PUT -H 'content-type: image/png' --upload-file ./logo.png "$(echo $RESP | jq -r .url)"

   aws s3 ls "s3://$(terraform output -raw uploads_bucket)/uploads/"

   ── expected output ──

   200

   2026-09-26 14:02:51 4821 3c9b1f0e-8a2d-4f6b-9e41-7d20c3a5b6e8-logo.png

Make each change, run the command, and read the error before revealing the diagnosis. Recognising these messages on sight is what makes you fast on a real team. Undo the change afterwards.