<p>As you point out, <a href="https://docs.aws.amazon.com/AmazonS3/latest/dev/NotificationHowTo.html#notification-how-to-event-types-and-destinations" rel="nofollow noreferrer">AWS S3 currently does not have an event type</a> for GET calls.</p>

<p>To do something similar to what you are trying to do, I had to do the following:</p>

<ol>
<li>Create an application/lamdba that's only purpose was to retrieve items from the S3 Bucket.  This application was given exclusive privileges to the S3 bucket.</li>
<li>The application keeps a counter of the number of times that S3 resource has been accessed.</li>
<li>The application returns the 403 or whatever you want if you exceed the download limit.</li>
</ol>

<p>Basically create a "middleware" that's sole purpose is to go from your website/application to S3 and track the number of requests.</p>

<p>While the above solution meets your requirements, it is vulnerable to common attacks such as DDoS or people spoofing their IP.  If you take this approach consider additional security measures (e.g. only authenticated users can invoke the application's GET call to S3).  </p>

CC BY-SA 4.0
2019-08-26T17:13:30.323Z
What I have done is to create an application which gets signed url's from AWS and delivers them back to the end user while at the same time keeps record of how many times a signed url was generated for any given file. Works perfectly.
W.M.
CC BY-SA 4.0
2019-09-02T00:00:05.413Z
@W.M. this is probably the best approach. It's more secure, cheaper and easier to control. +1
SyCode
CC BY-SA 4.0
2019-08-26T14:30:31.003Z
2019-08-26T14:30:31.003Z
Wesley Rolnick
<p>I have managed to trigger events on my bucket when objects are uploaded (<code>PUT</code>) but I am surprised that there are no triggers called when objects are downloaded (<code>GETs</code>), as can be seen in this screenshot of the interface:</p>

<p><a href="https://i.sstatic.net/lPKi9.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/lPKi9.png" alt="enter image description here"></a></p>

<p>I want to be notified of each download so I will be able to limit the downloads of any given object to a maximum of 10 times.</p>

<p>How to do that?</p>

<p>I am aiming at setting a tag named for example <code>limit_reached</code>, value: <code>true</code> on the file object if the download limit is reached and returning <code>403</code> by conditional access policy based on the <code>limit_reached</code> tag.</p>

<p>Alternative to all this, is to generate signed url's by my web application and track how many signed urls have been generated for a given object and denying any further after generating signed urls 10 times.</p>

<p>Your ideas are highly appreciated.</p>

<amazon-web-services><amazon-s3>
Triggering a SNS notification when an object is accessed (downloaded) in AWS S3
W.M.
# Triggering a SNS notification when an object is accessed (downloaded) in AWS S3

(Asked by: username_0 on 2019-08-25)

I have managed to trigger events on my bucket when objects are uploaded (`PUT`) but I am surprised that there are no triggers called when objects are downloaded (`GETs`), as can be seen in this screenshot of the interface:

[![enter image description here](https://i.sstatic.net/lPKi9.png)](https://i.sstatic.net/lPKi9.png)

I want to be notified of each download so I will be able to limit the downloads of any given object to a maximum of 10 times.

How to do that?

I am aiming at setting a tag named for example `limit_reached`, value: `true` on the file object if the download limit is reached and returning `403` by conditional access policy based on the `limit_reached` tag.

Alternative to all this, is to generate signed url's by my web application and track how many signed urls have been generated for a given object and denying any further after generating signed urls 10 times.

Your ideas are highly appreciated.

**Tags:** amazon-web-services, amazon-s3


---

## 1 answers

### Answer by username_1 on 2019-08-26. Score: 2 | Accepted answer

As you point out, [AWS S3 currently does not have an event type](https://docs.aws.amazon.com/AmazonS3/latest/dev/NotificationHowTo.html#notification-how-to-event-types-and-destinations) for GET calls.

To do something similar to what you are trying to do, I had to do the following:

1. Create an application/lamdba that's only purpose was to retrieve items from the S3 Bucket. This application was given exclusive privileges to the S3 bucket.
2. The application keeps a counter of the number of times that S3 resource has been accessed.
3. The application returns the 403 or whatever you want if you exceed the download limit.

Basically create a "middleware" that's sole purpose is to go from your website/application to S3 and track the number of requests.

While the above solution meets your requirements, it is vulnerable to common attacks such as DDoS or people spoofing their IP. If you take this approach consider additional security measures (e.g. only authenticated users can invoke the application's GET call to S3).

> **Comments:**
> **username_0**: What I have done is to create an application which gets signed url's from AWS and delivers them back to the end user while at the same time keeps record of how many times a signed url was generated for any given file. Works perfectly.  
> **username_2**: @username_0 this is probably the best approach. It's more secure, cheaper and easier to control. +1  

---

