Skip to content

Commit 391cd9e

Browse files
authored
improve signed s3 objects docs (#1040)
* improve signed s3 objects docs * docs nits
1 parent 40f984d commit 391cd9e

File tree

2 files changed

+9
-11
lines changed
  • docs
    • apps/4_app_configuration_settings
    • core_concepts/38_object_storage_in_windmill

2 files changed

+9
-11
lines changed

docs/apps/4_app_configuration_settings/image.mdx

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -36,11 +36,6 @@ The following section details Image component's specific settings. For more deta
3636

3737
> Example of picking an image from the [workspace storage](../../core_concepts/38_object_storage_in_windmill/index.mdx#workspace-object-storage) bucket.
3838
39-
## Public app access for S3 images
40-
41-
You should sign s3 objects before passing them to the image component in a public app.
42-
Learn more about it [here](../../core_concepts/38_object_storage_in_windmill/index.mdx#s3-object-signing-for-image-access-in-public-apps).
43-
4439
## Outputs
4540

4641
| Name | Type | Description |

docs/core_concepts/38_object_storage_in_windmill/index.mdx

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -363,13 +363,16 @@ Learn more about it in the [Data pipelines](../27_data_pipelines/index.mdx) sect
363363
/>
364364
</div>
365365

366-
### S3 object signing for image access in public apps
366+
### Dynamic S3 object access in public apps
367367

368-
The TypeScript and Python Windmill clients include functions to generate signed S3 objects.
369-
These objects can be used to [display s3 images in public apps](../../apps/4_app_configuration_settings/image.mdx#public-app-access-for-s3-images).
370-
The functions are `wmill.signS3Object` for TypeScript and `wmill.sign_s3_object` for Python (or `wmill.signS3Objects` and `wmill.sign_s3_objects` for multiple objects).
371-
They take an `S3Object` as input and return an `S3Object` with an additional `presigned` property which contains a signature making the object publicly available.
372-
Once you have a signed S3 object, you can pass it directly to the image component in an app.
368+
For security reasons, dynamic S3 objects are not accessible by default in public apps when users aren't logged in.
369+
To make them publicly accessible, you need to sign S3 objects using Windmill's built-in helpers:
370+
- TypeScript: `wmill.signS3Object()` (single) / `wmill.signS3Objects()` (multiple)
371+
- Python: `wmill.sign_s3_object()` (single) / `wmill.sign_s3_objects()` (multiple)
372+
373+
These functions take an `S3Object` as input and return an `S3Object` with an additional `presigned` property containing a signature that makes the object publicly accessible.
374+
375+
Signed S3 objects are supported by the [Image](../../apps/4_app_configuration_settings/image.mdx), [Rich result](../../apps/4_app_configuration_settings/rich_result.mdx) and [Rich result by job id](../../apps/4_app_configuration_settings/rich_result_by_job_id.mdx) app components.
373376

374377
## Instance object storage
375378

0 commit comments

Comments
 (0)