Support S3 v4 signatures for buckets secured with KMS customer managed keys #3772

New Issue

OVERLORD · 2026-02-05T07:24:46+03:00

OVERLORD commented

2026-02-05 07:24:46 +03:00

Originally created by @zonywhoop on GitHub (Apr 30, 2023).

Describe the feature you'd like

When using a customer managed key for KMS encryption of an S3 bucket all GET and HEAD requests must be signed using an AWS v4 signature. Because Bookstack does not do this, even public files are not accessible. This feature is available in Laravel 9 already using the temporaryURL() method on the storage facade as noted here:
https://laravel.com/docs/10.x/filesystem#temporary-urls

Describe the benefits this would bring to existing BookStack users

Allowing this method of file access also allows for use of files stored in private buckets which is requirement for many companies that are seeking high end compliances such as SOC2, HIPAA, or PCI.

Can the goal of this request already be achieved via other means?

No

Have you searched for an existing open/closed issue?

I have searched for existing issues and none cover my fundemental request

How long have you been using BookStack?

Over 5 years

Additional context

No response

Originally created by @zonywhoop on GitHub (Apr 30, 2023). ### Describe the feature you'd like When using a customer managed key for KMS encryption of an S3 bucket all GET and HEAD requests must be signed using an AWS v4 signature. Because Bookstack does not do this, even public files are not accessible. This feature is available in Laravel 9 already using the temporaryURL() method on the storage facade as noted here: https://laravel.com/docs/10.x/filesystem#temporary-urls ### Describe the benefits this would bring to existing BookStack users Allowing this method of file access also allows for use of files stored in private buckets which is requirement for many companies that are seeking high end compliances such as SOC2, HIPAA, or PCI. ### Can the goal of this request already be achieved via other means? No ### Have you searched for an existing open/closed issue? - [X] I have searched for existing issues and none cover my fundemental request ### How long have you been using BookStack? Over 5 years ### Additional context _No response_

OVERLORD added the 🔨 Feature Request :cat2:🐈 Possible duplicate labels 2026-02-05 07:24:46 +03:00

OVERLORD closed this issue

2026-02-05 07:24:49 +03:00

OVERLORD commented

2026-02-05 07:24:51 +03:00

@ssddanbrown commented on GitHub (Apr 30, 2023):

Thanks for the request, I'm going to close this off though as a duplicate of #763 which is essentially already existing as an issue to support AWS signed URLs.

@ssddanbrown commented on GitHub (Apr 30, 2023): Thanks for the request, I'm going to close this off though as a duplicate of #763 which is essentially already existing as an issue to support AWS signed URLs.

OVERLORD commented

2026-02-05 07:24:54 +03:00

@zonywhoop commented on GitHub (Apr 30, 2023):

@ssddanbrown, I saw #763, and while similar, this change would implement a smaller subset (download only) of the features required there. I also may be able to knock this out and provide a PR in the next week or two. Happy to work that against #763 as a partial implementation.

@zonywhoop commented on GitHub (Apr 30, 2023): @ssddanbrown, I saw #763, and while similar, this change would implement a smaller subset (download only) of the features required there. I also may be able to knock this out and provide a PR in the next week or two. Happy to work that against #763 as a partial implementation.

OVERLORD commented

2026-02-05 07:25:00 +03:00

@ssddanbrown commented on GitHub (Apr 30, 2023):

@zonywhoop I'm fairly sure the mention of "Upload" in #763 is matter of translation, and would more accurately be referred to as "storage" in that context.

To be honest, I don't think I'd accept a PR for this right now since the demand is so minor to be worth expanding the scope of support here.

@ssddanbrown commented on GitHub (Apr 30, 2023): @zonywhoop I'm fairly sure the mention of "Upload" in #763 is matter of translation, and would more accurately be referred to as "storage" in that context. To be honest, I don't think I'd accept a PR for this right now since the demand is so minor to be worth expanding the scope of support here.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#3772