Amazon S3

How can you save a customer’s receipt in Amazon S3?

Create a private bucket, a named place in AWS for files. Your app saves the receipt’s file key, which is the name S3 uses to find it, alongside the expense record. The receipt itself stays in the bucket.

You can upload a made-up receipt in the AWS console before connecting the app. For a customer upload, your app checks the customer’s sign-in and gives their browser a temporary upload link for one new key. If the browser sends the file straight to S3 from your site, your developer also sets which website can make that request. The AWS credential that creates links stays on the server, where the visitor cannot see it.

Who can open a receipt once it has been uploaded?

Keep Block Public Access on. Have your app check who owns the expense before it creates a short-lived download link. Anyone holding that link can normally use it until it expires, so issue it only when needed.

Use a new app-generated key for each upload. S3 can accept another upload to the same key through the same valid link. Keep the allowed file type and size small for your feature, and have your developer enforce those limits. A signed POST policy can enforce a size range. The declared content type still needs an actual file check before staff open the receipt.

1. 1
   Upload a fictional receipt

   Use a separate test bucket and two disposable accounts. Save a small PDF you made under the first account. Reload and check the file opens from its expense.
2. 2
   Check the other account

   Use a fresh browser session for the second account. The app should decline to issue a download link for the first account’s receipt. Check the unsigned file address while signed out as well.
3. 3
   Check the temporary grant

   Use only the fictional file to confirm the signed link works before expiry. After the link expires, make a fresh request and confirm it cannot start a new download. Get a fresh link through the authorized app if you need the receipt again.

What does a small S3 storage bill measure?

AWS bills separately for space, requests to do things like upload or download, and some data transfers. A small library of files can still get a lot of reads. Use the region where you will keep the bucket when you estimate the bill.

Ten GB kept for a full month, 1,000 requests in the upload tier and 10,000 ordinary reads come to about $0.24 on those three lines. That excludes data transfer, any extra features, taxes and credits. Keeping old versions adds storage. Check the destination and the amount transferred before adding a download cost to the estimate.

Can you recover a deleted receipt or move it out of S3?

You can download a test receipt from the AWS console. Your developer can also copy files in bulk with AWS tools. Export the expense records and the file keys too so the new app knows which receipt belongs to which account.

Versioning can preserve an older copy if you enable it before a change and the version is still retained. In a versioned bucket, a simple delete normally hides the file behind a delete marker. Permanently deleting a version removes that recovery option. If the file was moved to an archive class that requires restoration, restore it before you can download it. Practise recovery in a separate bucket and check that the restored file opens from the right expense.