Is there a way to limit object size when uploading in a bucket ?

[Champomix]

Is your feature request related to a problem? Please describe.
I m wondering if it is possible to limit the size of an object when uploading in a bucket with sdk or presigned url ?

Describe the solution you'd like
when the object exceed the parametrized size limit (1 Mo for example), the uplod opréation (putObject or PUT/POST HTTP) would return a error with a message saying that the limit has been reached.

[harshavardhana]

The maximum object size allowed is 5TiB - there is no other way to limit object size per bucket, there is no S3 API for that and we do not have any such provisions naturally.

Do not think we may ever do this.

[zanzlender]

What about Post URL policies? https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-post-example.html

If not... how could one stop malicious users from taking that URL and uploading whatever they wanted through it?

[harshavardhana]

Add a checksum for your payload that is expected, once checksum is correct the PUT will be expected.

[zanzlender]

Thanks for the reply :)

So just to clarify my usecase... I have my MinIO instance running, an express backend with React for Client, and I want to use presignedUrl (ideally with restrictions included)

My flow:

#	CLIENT	EXPRESS BACKEND	MINIO
1st	Generate checksum for desired file ???
2nd	Request presigned url from EB, send checksum
3rd		Generate Presigned URL and send to C (include checksum in presigned url???)
4th	Upload to Minio
5th			Validate file?? (MinIO validates checksum???) and handle upload

I tried to get the PostPolicy to work, but my POST uploads always fail for some reason... Is there any documentation on what MinIO requires when receiving a POST upload?

Also, if I wanted to do that with PUT, I would not be able to as you say?

My results

• presignedPutUrl --> Works as intended, but is not safe because technically anyone can take the URL and upload within the expiration time - there is also no file size checking. (you said to include the checksum but I don't know who is supposed to validate - me? MinIO? - so I'm not sure where to put it - in header? in request?)
• POST upload with PostPolicy - I tried but all uploads fail with An error occurred when parsing the HTTP request POST at '/my-bucket', also could not find any documentation on how POST uploads are supposed to work from the client.

What I tried:

    <form
        name="myform"
        encType="multipart/form-data"
        method="POST"
        onSubmit={async (e) => {
          e.preventDefault();

          const formData = new FormData(e.currentTarget);

          // generated by minioClient but copied for simplicity
          const postPolicy = {
            postURL: "http://localhost:8001/my-bucket",
            formData: {
              bucket: "my-bucket",
              key: "profile-images/sdas.png",
              "Content-Type": "image/png",
              "Content-Disposition": "attachment; filename=sdas.png",
              "x-amz-date": "20240510T124501Z",
              "x-amz-algorithm": "AWS4-HMAC-SHA256",
              "x-amz-credential":
                "JJtetbdFP9nyGrG4x7iQ/20240510/us-east-1/s3/aws4_request",
              policy:
         "eyJjb25kaXRpb25zIjpbWyJlcSIsIiRidWNrZXQiLCJ0YXNreS1hcHAiXSxbImVxIiwiJGtleSIsInByb2ZpbGUtaW1hZ2VzL3NkYXMucG5nIl0sWyJlcSIsIiRDb250ZW50LVR5cGUiLCJpbWFnZS9wbmciXSxbImVxIiwiJENvbnRlbnQtRGlzcG9zaXRpb24iLCJhdHRhY2htZW50OyBmaWxlbmFtZT1zZGFzLnBuZyJdLFsiY29udGVudC1sZW5ndGgtcmFuZ2UiLDEwMjQsMTA0ODU3NjAwXSxbImVxIiwiJHgtYW16LWRhdGUiLCIyMDI0MDUxMFQxMjQ1MDFaIl0sWyJlcSIsIiR4LWFtei1hbGdvcml0aG0iLCJBV1M0LUhNQUMtU0hBMjU2Il0sWyJlcSIsIiR4LWFtei1jcmVkZW50aWFsIiwiSkp0ZXRiZEZQOW55R3JHNHg3aVEvMjAyNDA1MTAvdXMtZWFzdC0xL3MzL2F3czRfcmVxdWVzdCJdXSwiZXhwaXJhdGlvbiI6IjIwMjQtMDUtMTBUMTI6NDY6MjguMTkyWiJ9",
              "x-amz-signature":
                "4a41092505103f5182aa89ddde35c1153b6235e2c49ccfd963adf8b4f0be063b",
            },
          };

          formData.append("bucket", postPolicy.formData.bucket);
          formData.append("key", postPolicy.formData.key);
          formData.append("policy", postPolicy.formData.policy);
          formData.append("x-amz-credential", postPolicy.formData["x-amz-credential"]);
          formData.append("x-amz-algorithm", postPolicy.formData["x-amz-algorithm"]);
          formData.append("x-amz-date", postPolicy.formData["x-amz-date"]);
          formData.append("x-amz-signature", postPolicy.formData["x-amz-signature"]);
          formData.append("Content-Type", postPolicy.formData["Content-Type"]);
          formData.append("Content-Disposition", postPolicy.formData["Content-Disposition"]);

          try {
            const response = await fetch(postPolicy.postURL, {
              method: "POST",
              body: formData,
              headers: {
               // if this is not included in headers then I get other request errors like "missing key"
                ...postPolicy.formData,
              },
            });

            console.log("response", response);
          } catch (err) {
            console.log("err", err);
          }
        }}
      >
        <input type="file" name="file" />

        <button className="border-4 bg-red-500 text-white" type="submit">
          Submit
        </button>
      </form>