S3cret Agent: Build an AI That Generates AWS Presigned URLs on Command

This project implements an AI-powered LangChain agent that dynamically generates AWS S3 Presigned URLs (GET or PUT) based on natural language input. The agent is wrapped in a FastAPI server and supports integration into secure backend workflows.

🧠 What It Does

• Accepts input like: Generate download link bucket=my-bucket key=path/to/file.txt
• Uses LangChain tools to interpret commands
• Generates a presigned URL via boto3
• Responds with a secure, time-limited URL (GET/PUT)

🧱 Tech Stack

• 🧠 LangChain
• 🔐 AWS S3 + Boto3
• ⚡ FastAPI
• 🐳 Docker-ready

📁 Folder Structure

langchain_s3_agent/
├── main.py # FastAPI app
├── agent.py # LangChain agent logic
├── aws_utils.py # Presigned URL generator
├── .env # AWS credentials (not committed)
├── requirements.txt
└── Dockerfile (optional)

🚀 Quick Start

1️⃣ Clone and Install

git clone https://github.com/your-repo/langchain-s3-agent.git cd langchain-s3-agent pip install -r requirements.txt 

2️⃣ Add AWS Credentials to .env
env
AWS_ACCESS_KEY_ID=your_key
AWS_SECRET_ACCESS_KEY=your_secret
AWS_REGION=us-east-1
3️⃣ Run the API

uvicorn main:app --reload 

📡 How to Use
POST /query
Request Body:

 { "query": "Generate download link bucket=my-bucket key=path/to/file.txt" } 

Response:

 { "response": "GET URL for `path/to/file.txt`: https://s3.amazonaws.com/..." } 

🧠 Supported Prompts
Action Prompt Format Example
Download Generate download link bucket=my-bucket key=folder/file.txt
Upload Generate upload link bucket=my-bucket key=uploads/newfile.txt

🧪 Example CURL Test

 curl -X POST http://localhost:8000/query \ -H "Content-Type: application/json" \ -d '{"query": "Generate upload link bucket=my-bucket key=upload/test.txt"}' 

🐳 Optional: Docker Support
Dockerfile
dockerfile

FROM python:3.11 WORKDIR /app COPY . . RUN pip install -r requirements.txt CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000"] 

Build & Run

docker build -t s3-agent . docker run -p 8000:8000 --env-file .env s3-agent 

🔐 IAM Policy Required
Your AWS IAM user or role must have:

 { "Effect": "Allow", "Action": ["s3:GetObject", "s3:PutObject"], "Resource": "arn:aws:s3:::your-bucket-name/*" } 

📌 Roadmap Ideas
Add expiration input (expires_in=600)

Enable presigned POST for HTML form uploads

Add token auth to protect the API

Web UI with React or Streamlit

📘 Resources
AWS S3 Presigned URLs

Boto3 Docs

LangChain Docs

FastAPI Docs