Create a URL that can be used to issue a plain HTTP request to an internal stunnel proxy that will wrap it in HTTPS and send it on to S3.

Internal stunnel S3 proxy.md

S3 proxy

If you've got tools that don't speak HTTPS, then using stunnel in client mode you can wrap those requests in SSL on their way to S3. If you don't hijack the S3 DNS with iptables, then you'll need to send those URLs using the domain name of your internal stunnel proxy. This utility gives you one way to create those URLs. It's incomplete, and just to give you some ideas.

.env.example

export AWS_ACCESS_KEY_ID=EXAMPLEAMZEXAMPLE
export AWS_SECRET_ACCESS_KEY=1234example567secret
export S3_HTTP_PROXY=http://example.internal:1443

Gemfile

source 'https://rubygems.org'

gem 'aws-sdk'

s3_proxy.rb

require 'aws-sdk'

class S3Proxy

  def self.get bucket, key, expires=10*60
    object = s3.buckets[bucket].objects[key]
    url = object.url_for(:read, expires: expires)
    proxy.merge "/#{bucket}/#{key}?#{url.query}"
  end

  def self.proxy_url url, expires=nil
    url = URI(url)
    raise "#{self} can only proxy S3 urls" unless url.host =~ /s3.amazonaws.com$/
    bucket, _ = url.host.split('.')
    if bucket != 's3'
      key = url.path[1..-1]
    else
      _, bucket, *key = url.path.split('/')
      key = key.join('/')
    end
    get bucket, key
  end

  def self.s3
    @s3 ||= AWS::S3.new
  end

  def self.proxy
    @proxy ||= begin
      raise "S3_HTTP_PROXY not defined" unless ENV['S3_HTTP_PROXY']
      URI(ENV['S3_HTTP_PROXY'])
    end
  end

end


# If you only know the bucket & key
puts S3Proxy.get 'example-bucket', 'test_image.jpg'

# If you only know the URL
puts S3Proxy.proxy_url 'https://example-bucket.s3.amazonaws.com/some-dir/test_image.jpg'

stunnel.conf

client = yes

# Uncomment for debugging
# foreground = yes

[s3.amazonaws.com]
accept = localhost:18443
connect = s3.amazonaws.com:443