[小ネタ] S3にアップロードされたファイルタイプの真偽を見抜く

{
    "Version": "2012-10-17",
    "Id": "AllowOnlyJpgUpload",
    "Statement": [
        {
            "Sid": "DenyNonJpgUpload",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:PutObject",
            "NotResource": "arn:aws:s3:::{バケット名}/*.jpg"
        }
    ]
}

aws iam create-role \
  --role-name image-extension-validation-function-role \
  --assume-role-policy-document '{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Principal": {
          "Service": "lambda.amazonaws.com"
        },
        "Action": "sts:AssumeRole"
      }
    ]
  }'

aws iam attach-role-policy \
  --role-name image-extension-validation-function-role \
  --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole

aws iam attach-role-policy \
  --role-name image-extension-validation-function-role \
  --policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess

import boto3
import magic
import urllib.parse

s3 = boto3.client('s3')

def lambda_handler(event, context):
    record = event['Records'][0]
    bucket = record['s3']['bucket']['name']
    key = urllib.parse.unquote_plus(record['s3']['object']['key'])

    obj = s3.get_object(Bucket=bucket, Key=key)

    body = obj['Body'].read(1024)
    mime = magic.from_buffer(body, mime=True)
    print(f"[ファイル] {key} の実際のMIMEタイプ: {mime}")

    if key.endswith('.jpg') and mime != 'image/jpeg':
        print(f"警告: {key} はJPEGではありません！（実際: {mime}）")

body = obj['Body'].read(1024)
mime = magic.from_buffer(body, mime=True)

{  
   "Records":[  
      {  
         "eventVersion":"2.2",
         "eventSource":"aws:s3",
         "awsRegion":"us-west-2",
         "eventTime":"The time, in ISO-8601 format, for example, 1970-01-01T00:00:00.000Z, when Amazon S3 finished processing the request",
         "eventName":"event-type",
         "userIdentity":{  
            "principalId":"Amazon-customer-ID-of-the-user-who-caused-the-event"
         },
         "requestParameters":{  
            "sourceIPAddress":"ip-address-where-request-came-from"
         },
         "responseElements":{  
            "x-amz-request-id":"Amazon S3 generated request ID",
            "x-amz-id-2":"Amazon S3 host that processed the request"
         },
         "s3":{  
            "s3SchemaVersion":"1.0",
            "configurationId":"ID found in the bucket notification configuration",
            "bucket":{  
               "name":"amzn-s3-demo-bucket",
               "ownerIdentity":{  
                  "principalId":"Amazon-customer-ID-of-the-bucket-owner"
               },
               "arn":"bucket-ARN"
            },
            "object":{  
               "key":"object-key",
               "size":"object-size in bytes",
               "eTag":"object eTag",
               "versionId":"object version if bucket is versioning-enabled, otherwise null",
               "sequencer": "a string representation of a hexadecimal value used to determine event sequence, only used with PUTs and DELETEs"
            }
         },
         "glacierEventData": {
            "restoreEventData": {
               "lifecycleRestorationExpiryTime": "The time, in ISO-8601 format, for example, 1970-01-01T00:00:00.000Z, of Restore Expiry",
               "lifecycleRestoreStorageClass": "Source storage class for restore"
            }
         }
      }
   ]
}

openssl enc -aes-256-cbc -in ohanami_walk_mask.jpg -out encrypted_ohanami_walk_mask.jpg