Mobile (Client) to Amazon S3 (Server) - Architecture

Question

let's start off with the problem statement:

My iOS application has a login form. When the user logs in, a call is made to my API and access granted or denied. If access was granted, I want the user to be able to upload pictures to his account and/or manage them.

As storage I've picked Amazon S3, and I figured it'd be a good idea to have one bucket called "myappphotos" for instance, which contains lots of folders. The folder names are hashes of a user's email and a secret key. So, every user has his own, unique folder in my Amazon S3 bucket.

Since I've just recently started working with AWS, here's my question:

What are the best practices for setting up a system like this? I want the user to be able to upload pictures directly to Amazon S3, but of course I cannot hard-code the access key. So I need my API to somehow talk to Amazon and request an access token of sorts - only for the particular folder that belongs to the user I'm making the request for.

Can anyone help me out and/or guide me to some sources where a similar problem was addressed? Don't think I'm the first one and the amazon documentation is so extensive that I don't really know where to start looking.

Answer 1

I would likely start with storing the S3 folders information on a DB and have the API handle the storage information according to the user's login information.

The iOS device shouldn't really care what the S3 is as the API should act as the proxy to Amazon.

If you're using .Net, here is a helpful link. It's basically saying, you need to create a zero byte object to create a folder.