How to Display Private S3 Images in Explo

Last updated: December 12, 2024

Explo supports displaying images in tables and the image component, but when working with private S3 images, some additional steps are required. This article explains how to set up your Explo tables to show images stored in private S3 buckets.

Understanding the Challenge

When dealing with private S3 images, direct URLs cannot be used in Explo tables because they require authentication. The solution is to generate pre-signed URLs that provide temporary access to these images.

Generating pre-signed URLs using AWS Lambda

An AWS Lambda function may easily be written, published, and registered in your Postgres RDS instance to generate temporary, pre-signed URLs for s3 assets.

Pre-requisites

  1. Your database must be Postgres and must be managed by AWS via RDS.

  2. Your database version must be > 12.6 or > 13.2 or > 14.1 or > 15

Implementing the Lambda Solution

  1. Write a Lambda function that returns a pre-signed URL for a given S3 path.

  2. Add the aws_lambda extension to your RDS instance.

  3. Register your Lambda function in your PostgreSQL instance.

  4. Update your queries to reference the Lambda function.

For detailed instructions on using the AWS Lambda extension with PostgreSQL, refer to the AWS RDS PostgreSQL Lambda Guide.

Configuring Explo to Display Images

Once you have your pre-signed URLs, you can configure Explo to display the images:

Image Component:

  1. Paste the pre-signed url into the component configuration and the image should load immediately.

In Tables:

  1. In your Explo table configuration, go to the Format tab.

  2. For the column containing your pre-signed URLs, select the image format option.

  3. Explo will now render the URLs as images in your table.

Note: Ensure that your pre-signed URLs have an appropriate expiration time. If the URLs expire too quickly, the images may not load in Explo.

Security Considerations

When implementing this solution, keep in mind:

  • Ensure that your RDS instance has the minimum required permissions to access the S3 bucket.

  • Regularly rotate any AWS credentials used in your PostgreSQL functions or Lambda functions.

  • Set an appropriate expiration time for pre-signed URLs to balance security and usability.

By following these steps, you can securely display private S3 images in your Explo tables while maintaining the privacy and security of your data.