rusty-s3

rusty-s3 is a pure Rust client SDK for Amazon S3 and S3-compatible object stores (MinIO is tested on every commit), built on a Sans-IO design: the crate handles AWS Signature Version 4 request signing and response parsing, but never performs I/O itself, leaving callers free to use any HTTP client (blocking, async, or WASM) they prefer.

It covers the most commonly used S3 operations — bucket creation/deletion, object get/put/head/delete, batch delete, listing, and the full multipart upload lifecycle (create, upload part, list parts, complete, abort) — with a small, ergonomic action-based API and optional presigned-URL generation.

What You Get

• Sans-IO request signing (AWS Signature V4) and response parsing for common S3 actions, decoupled from any specific HTTP client
• Bucket-level operations: CreateBucket, DeleteBucket, HeadBucket
• Object-level operations: GetObject, PutObject, HeadObject, DeleteObject, DeleteObjects, ListObjectsV2
• Full multipart upload support: CreateMultipartUpload, UploadPart, ListParts, CompleteMultipartUpload, AbortMultipartUpload
• Presigned URL generation for direct client-side upload/download without proxying through the application
• Pluggable crypto backends (RustCrypto, aws-lc-rs, or graviola) selected via Cargo features

Common Use Cases

• Adding S3-compatible object storage support to a Rust backend without depending on the full AWS SDK for Rust
• Generating presigned upload/download URLs for clients to talk to S3 directly
• Talking to MinIO or other S3-compatible self-hosted object stores from a Rust service
• Building a WASM application that needs to sign and issue S3 requests via the browser’s fetch API

Under The Hood

Architecture The crate follows a strict Sans-IO pattern: Bucket, Credentials, and per-operation Action types (in src/actions/) build and sign an HTTP request description (method, URL, headers, body) without ever opening a socket, using src/signing/ for AWS SigV4 canonicalization and src/credentials/ for key management; callers then execute the request with whatever HTTP client they already depend on and hand the response back for parsing. Tech Stack Rust 2024 edition (MSRV 1.85), using jiff for time handling, url/percent-encoding for URL construction, and zeroize to scrub credentials from memory; cryptographic signing is feature-gated across rustcrypto (hmac/sha2), aws-lc-rs, and graviola backends, and the full feature adds serde/instant-xml/base64/md-5 for response deserialization. Code Quality Integration tests (tests/upload_download.rs, list_parts.rs, delete_objects.rs, create_delete_bucket.rs) exercise real S3-compatible behavior and run against MinIO in CI on every commit, alongside Criterion benchmarks (benches/actions) and an extensive Clippy lint configuration (complexity, correctness, nursery, pedantic, perf, style, suspicious all enabled). API Design The API centers on a Bucket + Credentials pair producing Action objects (e.g. bucket.get_object(credentials, key)) that can be .sign()ed into a presigned URL or turned into a request description — a small, composable surface that keeps HTTP-client choice, async runtime, and crypto backend fully decoupled from the S3 protocol logic itself.