We Keep Coding

Upload a document to S3 via MS Office Add In

We are trying to create a JS MS Office add in that will let users save a document to an S3 bucket, however I am not seeing any way to do that. Has anyone had any success getting this to wrok?

You can use the Amazon SDK for JavaScript to interact with an Amazon S3 bucket. See Uploading Photos to Amazon S3 from a Browser for more information. Don't forget to configure CORS correctly as described in the article mentioned.

uploading file to s3 bucket from s3 url

I'm new to web development and server requests, I have a url to an amazon s3 bucket and I have all the required values, such as key, policy, security token, signature, and the file I want to upload etc. I was wondering how I would actually upload the file to the s3 bucket in javascript. Would I use:
$.post, or something else and what would the parameters be for the request and the format. Currently I keep getting error 412 or 403.
Thanks

I would suggest using the AWS Javascript SDK which is a library of functions for interacting with AWS service endpoints. If you attempt to post directly to a service endpoint or s3 URL then you will be expected to have signed the call using the standard AWS Signature v4 which can be hard to implement and is done for you in the SDK libraries.
The SDK will also correctly integrate with IAM permissions which you typically need to have correctly setup to write to a bucket.
A full example is provided here

AWS S3 JavaScript browser upload without access key

I want to upload a file to S3, preferably not through a backend server, but only through browser.
In AWS example, to create an S3 client, I need to provide secret key and secret id:
const S3 = new AWS.S3({
accessKeyId: <ACCESS_KEY_ID>,
secretAccessKey: <ACCESS_KEY_SECRET>,
region: <AWS_REGION>
});
But I don't want to expose my access keys. The website is hosted in CloudFront, is it possible to setup permission between the CloudFront and S3 bucket so that I don't need to provide credentials in JavaScript?

For security reasons you should generally have some way to audit the source of an object upload to S3 (it could afterall be anything if you're allowing public access).
Rather than allowing completely public access it might be better to setup AWS Cognito and use it on your frontend.
You'd have the choice for one of the below scenarios:
User signs in via a cognito user
The anonymous user is used.
Both of these options will generate temporary credentials that can be used by your frontend. This will prevent a user making a note of them and keeping them forever, ensure you lockdown the permissions to be a putObject only for that specific S3 bucket.
An alternative approach is to use API Gateway and Lambda to generate a presigned URL that can support uploads. For more information on this approach take a look at this article.
To enhance your security it is probably worth adding an S3 event to trigger a Lambda that will validate the object after it has been uploaded.

You need some kind of backend in order to hide your credentials effectively. Since you're already in the AWS universe, you could use an AWS Lambda function that returns a so-called pre-signed upload url to your frontend which you can use to upload your binaries.
More info:
AWS S3 Presigned URLs

You need to use S3 presigned URLs. Your backend generates a special URL that contains a signature and send it to the browser. Then the browser can use that URL to send a POST request (or a PUT request, but that is a signed PUT URL) to upload the file directly to the S3 bucket. No access keys are exposed to the client.
You still need to add access keys to your backend, which can be through roles if it is inside AWS. But these keys don't reach the browser, only the signature.
I've written about this topic extensively and also made code examples you can check.

Best way to upload a file to a non-public S3 bucket without exposing access key

I have a static website hosted on an S3 bucket. The website takes a file as an input and uploads it to another S3 bucket. I don't want to keep the bucket as public. How can I upload a file to a non-public bucket? Currently, I'm using my access key to upload a file, but I don't want to expose the access key in my Javascript code for authentication. My objective is to upload a file to a non-public bucket without exposing my access credentials.
Edit1:
I used the amazon API gateway with Lambda to generate pre-signed S3 URL. This way my credentials don't get exposed.

You can use environment variables to hide API Keys for Javascript. React and Node examples
You could also use AWS Parameter Store to store the API Keys. There are examples of how to integrate with node.js and other frameworks.

AWS S3 - credentials exposed in code

I'm completely new to AWS and have some security issue.
I want to allow my user to upload a profile picture and I want to save it in S3.
My code looks like this:
import AWS_S3 from 'aws-sdk/clients/s3';
import config from '../../config';
const myS3Credentials = {
accessKeyId: config('AWSS3AccessKeyID'),
secretAcccessKey: config('AWSS3SecretAccessKey'),
};
console.log('myS3Credentials:', myS3Credentials);
const S3 = new AWS_S3({
credentials: myS3Credentials,
region: config('AWSS3Region'),
});
All of the variables (like AWSS3Region, and my credentials) are set up in the .env file. But here, I'm exposing them in the code. How to avoid that? Or should I set up some bucket permissions?

You can use the aws sdk getSignedUrl method which is exposed on the S3 object. This would allow you to upload to your bucket directly from the client without exposing your access tokens. You can keep your access tokens safe by leaving them in the .env file and keeping that file out of your repo.
Creating signed urls will require creating an endpoint on your server that would return the signed URL. From there you would perform a put request containing the image. I have created a gist with an example. In the gist there is client and server code. https://gist.github.com/pizza-r0b/35be6dd3e992ef1ebb2159772cb768c0

You should never, ever send/expose AWS access tokens directly in your client code.
Put that code on a server and make calls to your server code, which in turn makes calls to AWS.
On your server, you should never use hardcoded access keys either. Use environmental variables to get the access tokens, as Alejandro stated in his answer below.

Its strongly discouraged to store permanent credentials in your client code to upload files to S3. There are several approaches to handle this securely.
Get temporary access credentials from your backend using AWS STS SDK or using a service like AWS Cognito.
Use AWS CloudFront Signed URLs or Signed Cookies to send back to the client from Server so that, using them you can upload files to S3.
Few references are listed below to get you started with Signed Urls.
Uploading Objects Using Pre-Signed URLs
Node.js module to create and sign URLs to access private resources on Amazon S3

Just call on your code process.env.<YOUR_KEY>.