Skip to contents

presigned URL for a file on Cloudflare R2 or S3

Source: R/r2.R
presigned_url.Rd

URLs that grant time limited access to single files in a private bucket, without credentials. Anyone with the URL can download the file or, for method = "PUT", upload a file to that path until the URL expires, so treat the URL like a password.

Usage

presigned_url(path, expires = 3600, method = c("GET", "HEAD", "PUT"))

Arguments

path

file as r2://bucket/path or s3://bucket/path, or a vector of these.

expires

seconds the URLs are valid for, from 1 to 604800 (7 days), default 3600 (one hour).

method

HTTP method the URLs are valid for:

  • "GET" (default): download the file;

  • "HEAD": get the file's metadata;

  • "PUT": upload a file.

Value

the presigned URLs, one per path.

Details

The URLs are signed locally, creating them does not check that the files exist. The URLs stop working when the credentials they were signed with are revoked, and for temporary S3 credentials when these expire.

Credentials

Credentials come from environment variables, e.g. set in .Renviron, read at call time. Public URLs and local paths need none.

Paths on R2 (r2://bucket/path):

  • R2_ACCOUNT_ID: the R2 account id.

  • R2_ACCESS_KEY_ID and R2_SECRET_ACCESS_KEY: the access key id and secret access key of an R2 API token with access to the bucket.

  • R2_API_TOKEN, optional: the value of an API token with Zone Cache Purge permission (see create_r2_bucket()). Files that change on R2 then get purged from the Cloudflare cache of the bucket's custom domains, so that the new versions are served right away; the purge is skipped without it.

  • R2PARQUET_PURGE_ORIGINS, optional: the origins of web pages reading the bucket from a browser, comma separated, like https://example.com,https://www.example.com. Cloudflare caches the responses to their requests separately per Origin, which a purge of the plain URL misses, so each changed file also gets purged once per origin; copies cached for origins not listed are refreshed when the edge TTL runs out. This only concerns web apps, whose browsers send the Origin header; requests without one, like those of this package, DuckDB or curl, get the plain URL's copy, which is always purged.

Paths on S3 (s3://bucket/path), on Amazon S3 or another S3 compatible service like MinIO, use the variables AWS tools use:

  • AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY, and AWS_SESSION_TOKEN for temporary credentials.

  • AWS_REGION or AWS_DEFAULT_REGION: the region, default us-east-1.

  • AWS_ENDPOINT_URL_S3 or AWS_ENDPOINT_URL: the endpoint of other S3 compatible services, like http://localhost:9000, which get addressed with path style URLs (endpoint/bucket/key).

  • R2PARQUET_S3_URL_STYLE: path or vhost, overrides the URL style.

AWS profiles and single sign-on are not read, aws configure export-credentials --format env prints the variables for them.