> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# S3 Pre Signed URLs

> Explains Amazon S3 pre-signed URLs for granting short-lived, operation-specific access to objects securely.

In this lesson we cover Amazon S3 pre-signed URLs: what they solve, how they work, common patterns (private streaming and direct uploads), security considerations, and practical examples for generating them. Pre-signed URLs let you grant short-lived, operation-specific access to a single S3 object without making the bucket public or issuing AWS credentials to the recipient.

## What problem do pre-signed URLs solve?

* Many S3 buckets are private and require AWS IAM authentication to access objects.
* Sometimes you need to give a non-AWS user temporary access to a single object (for example, to download a receipt or upload a profile image) without making the entire bucket public or creating IAM credentials for that person.
* A pre-signed URL embeds a signature (derived from an IAM principal’s credentials) and an expiration time into a URL. Anyone holding that URL can perform the allowed operation (GET, PUT, etc.) on that object until the URL expires.

## How they work (high-level)

1. An authenticated IAM principal (user or role) with the appropriate permissions generates a pre-signed URL for a specific S3 operation and object.
2. The signing process produces a URL containing authentication metadata and an expiration timestamp.
3. Anyone with the URL can perform the specified operation against that object. When S3 receives the request, it validates the signature and verifies the permissions of the principal that created the signature (IAM policies, bucket policies, and ACLs are all evaluated).
4. After the URL expires, S3 rejects further requests made with that URL.

## Example use case — private video streaming

* Keep your video bucket private for paying customers.
* Your backend (authenticated as an IAM principal) generates a pre-signed GET URL for a specific video object on behalf of the authenticated customer.
* The client uses the pre-signed URL to stream the video directly from S3. S3 evaluates the request against the permissions of the signer and only allows access while the URL is valid.

![A slide titled "Pre-Signed URLs" showing a user avatar requesting a pre-signed URL from AWS Cloud; arrows show the cloud service (API/compute/storage icons) returning the URL. The diagram then shows the user using that URL to upload an image directly to a storage bucket.](https://mintcdn.com/kodekloud-c4ac6d9a/0PosiWhcA3oSA6T7/images/AWS-Certified-Developer-Associate/Storage/S3-Pre-Signed-URLs/presigned-url-aws-s3-direct-upload.jpg?fit=max\&auto=format\&n=0PosiWhcA3oSA6T7\&q=85\&s=c2bab111cac8ead63663505617d0ca8a)

## Example use case — direct uploads (bypass your backend)

* Traditional flow: client → your API server → S3. Your server handles every file transfer and bandwidth cost.
* With pre-signed PUT (or POST) URLs: your API only generates a short-lived pre-signed URL and returns it to the client. The client uploads directly to S3 using that URL, reducing backend load and increasing upload parallelism.

## Expiration and security considerations

Pre-signed URLs are time-limited. For Signature Version 4 generated from long-lived IAM user credentials, the maximum validity is seven days. If you generate pre-signed URLs using temporary credentials (for example, from STS AssumeRole), the URL cannot be valid for longer than the underlying temporary credentials' expiration. Choose expirations that balance usability and security.

* Generating a pre-signed URL does not change object or bucket permissions. The URL will only work if the IAM principal used to sign it had the required permission.
* Some SDKs may produce a signed URL even if signing credentials lack access; however, S3 will deny requests when the signer does not have permission.
* Consider mapping pre-signed URLs to your application-level authorization (for instance, one-time tokens or server-side records) if you need tighter control beyond S3’s IAM/bucket policy checks.

Do not embed very long expirations in public pages or client-side code. If credentials used to sign URLs are compromised, attackers can use already-issued pre-signed URLs until they expire. Always rotate signing credentials and monitor usage.

![A presentation slide titled "Pre-Signed URLs" showing a blue "Note" box and bullet points explaining expiration requirements and IAM/S3 access details for pre-signed URLs.](https://mintcdn.com/kodekloud-c4ac6d9a/0PosiWhcA3oSA6T7/images/AWS-Certified-Developer-Associate/Storage/S3-Pre-Signed-URLs/pre-signed-urls-expiration-iam-s3.jpg?fit=max\&auto=format\&n=0PosiWhcA3oSA6T7\&q=85\&s=c34ff8b0c213bb6a06bae5e7af8cc8a3)

## Permission model summary

* A pre-signed URL causes S3 to evaluate the request as if it were made by the IAM principal that generated the URL.
* The recipient is only authorized for the single operation and object encoded in the URL; they cannot use the URL to access other objects or operations.
* If the creator lacked permission to access the object, the pre-signed URL will not grant access to the recipient.

## Quick reference table

| Use case | Operation | Typical expiry | Notes |
| - | - | - | - |
| Temporary download for a user | `GET` | minutes → hours | Use short expirations for sensitive content |
| Client-side upload | `PUT` or form `POST` | minutes → hours | Reduces backend bandwidth; validate after upload |
| Streaming protected media | `GET` with range requests | minutes → hours | Combine with signed CloudFront URLs for advanced scenarios |
| CLI / one-off admin downloads | `GET` | up to 7 days (SigV4) | For long-lived credentials only — prefer short lived role credentials |

## Code examples

* Node.js (AWS SDK v3) — pre-signed GET URL

```javascript theme={null}
import { S3Client, GetObjectCommand } from "@aws-sdk/client-s3";
import { getSignedUrl } from "@aws-sdk/s3-request-presigner";

const s3 = new S3Client({ region: "us-east-1" });
const command = new GetObjectCommand({ Bucket: "my-bucket", Key: "path/to/object.mp4" });
const url = await getSignedUrl(s3, command, { expiresIn: 3600 }); // 1 hour
console.log(url);
```

* Node.js (AWS SDK v3) — pre-signed PUT URL for direct upload

```javascript theme={null}
import { S3Client, PutObjectCommand } from "@aws-sdk/client-s3";
import { getSignedUrl } from "@aws-sdk/s3-request-presigner";

const s3 = new S3Client({ region: "us-east-1" });
const putCmd = new PutObjectCommand({ Bucket: "my-bucket", Key: "uploads/user123/avatar.png", ContentType: "image/png" });
const putUrl = await getSignedUrl(s3, putCmd, { expiresIn: 900 }); // 15 minutes
console.log(putUrl);
```

* Python (boto3) — pre-signed URL

```python theme={null}
import boto3

s3 = boto3.client('s3', region_name='us-east-1')
url = s3.generate_presigned_url('get_object',
                                Params={'Bucket': 'my-bucket', 'Key': 'path/to/object.mp4'},
                                ExpiresIn=3600)  # 1 hour
print(url)
```

* AWS CLI — presign an object

```bash theme={null}
aws s3 presign s3://my-bucket/path/to/object.mp4 --expires-in 3600
```

## Best practices

* Keep expiry times as short as possible for the intended UX.
* Use pre-signed URLs to reduce backend bandwidth and scale uploads directly to S3.
* Rotate and monitor the credentials that generate signed URLs.
* For one-time downloads, record the issued URL server-side and expire it after the first use (application-level enforcement).
* For media streaming or more advanced distribution, combine S3 pre-signed URLs with CloudFront signed URLs for better caching, geo-restrictions, and URL customization.
* When using temporary credentials (STS AssumeRole), ensure the pre-signed URL expiry does not exceed the temporary credentials’ lifetime.

## References and further reading

* [AWS S3: Pre-signed URLs (documentation)](https://docs.aws.amazon.com/AmazonS3/latest/userguide/ShareObjectPreSignedURL.html)
* [AWS SDK for JavaScript v3 - Presigning S3 requests](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/modules/_aws_sdk_s3_request_presigner.html)
* [AWS CLI s3 presign command](https://docs.aws.amazon.com/cli/latest/reference/s3/presign.html)

In summary, pre-signed URLs are a straightforward, secure way to provide short-lived, operation-specific access to S3 objects. They enable clients to interact directly with S3 while S3 enforces permissions on behalf of the signer.

> **[Watch Video](https://learn.kodekloud.com/user/courses/aws-certified-developer-associate/module/e8ae2293-e16b-42d3-b32b-5c260a1f1e5d/lesson/6692ab4a-597f-426a-a539-2fff970bd417)**


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.