add aws s3 iam check (#5174)

api/.env.example

@@ -42,6 +42,7 @@ DB_DATABASE=dify
 # storage type: local, s3, azure-blob
 STORAGE_TYPE=local
 STORAGE_LOCAL_PATH=storage
+S3_USE_AWS_MANAGED_IAM=false
 S3_ENDPOINT=https://your-bucket-name.storage.s3.clooudflare.com
 S3_BUCKET_NAME=your-bucket-name
 S3_ACCESS_KEY=your-access-key

api/config.py

@@ -24,6 +24,7 @@ DEFAULTS = {
     'APP_WEB_URL': 'https://udify.app',
     'FILES_URL': '',
     'FILES_ACCESS_TIMEOUT': 300,
+    'S3_USE_AWS_MANAGED_IAM': 'False',
     'S3_ADDRESS_STYLE': 'auto',
     'STORAGE_TYPE': 'local',
     'STORAGE_LOCAL_PATH': 'storage',
@@ -226,6 +227,7 @@ class Config:
         self.STORAGE_LOCAL_PATH = get_env('STORAGE_LOCAL_PATH')
 
         # S3 Storage settings
+        self.S3_USE_AWS_MANAGED_IAM = get_bool_env('S3_USE_AWS_MANAGED_IAM')
         self.S3_ENDPOINT = get_env('S3_ENDPOINT')
         self.S3_BUCKET_NAME = get_env('S3_BUCKET_NAME')
         self.S3_ACCESS_KEY = get_env('S3_ACCESS_KEY')

api/extensions/storage/s3_storage.py

@@ -16,6 +16,10 @@ class S3Storage(BaseStorage):
         super().__init__(app)
         app_config = self.app.config
         self.bucket_name = app_config.get('S3_BUCKET_NAME')
+        if app_config.get('S3_USE_AWS_MANAGED_IAM'):
+            session = boto3.Session()
+            self.client = session.client('s3')
+        else:
             self.client = boto3.client(
                         's3',
                         aws_secret_access_key=app_config.get('S3_SECRET_KEY'),

docker/docker-compose.yaml

@@ -81,6 +81,7 @@ services:
       # only available when STORAGE_TYPE is `local`.
       STORAGE_LOCAL_PATH: storage
       # The S3 storage configurations, only available when STORAGE_TYPE is `s3`.
+      S3_USE_AWS_MANAGED_IAM: 'false'
       S3_ENDPOINT: 'https://xxx.r2.cloudflarestorage.com'
       S3_BUCKET_NAME: 'difyai'
       S3_ACCESS_KEY: 'ak-difyai'
@@ -236,6 +237,7 @@ services:
       STORAGE_TYPE: local
       STORAGE_LOCAL_PATH: storage
       # The S3 storage configurations, only available when STORAGE_TYPE is `s3`.
+      S3_USE_AWS_MANAGED_IAM: 'false'
       S3_ENDPOINT: 'https://xxx.r2.cloudflarestorage.com'
       S3_BUCKET_NAME: 'difyai'
       S3_ACCESS_KEY: 'ak-difyai'