S3 Pres Signed URLs

​

What problem do pre-signed URLs solve?

• You have a private S3 bucket (recommended for sensitive data).
• IAM-authenticated identities with proper permissions can get/put objects in that bucket.
• But sometimes you need to allow a non-AWS (public/unauthenticated) user to access a specific object temporarily.

• Create an AWS account for that person — impractical for most workflows.
• Make the bucket or object public — often undesirable for security and compliance.

​

Typical use cases

• Secure streaming of private videos (membership-only content).
• Letting clients upload directly to S3 from the browser or mobile app (reduces backend bandwidth).
• Sharing a single file with a contractor or vendor for a limited time.
• Temporary links for downloads in emails or support workflows.

• A video-hosting site stores large media files in private S3 buckets.
• When a paying user requests a video, the backend issues a pre-signed GET URL for the object and returns it to the client.
• The client fetches the video directly from S3 with the pre-signed URL. S3 authorizes the request using the credentials of the URL creator; users without the URL cannot access the private content.

​

Direct uploads: cut out the backend

1. Client requests a pre-signed upload URL from your API.
2. Your API (running with permissions to PutObject) generates a pre-signed PUT or POST URL and returns it to the client.
3. The client uploads directly to S3 using that pre-signed URL.

• Files do not traverse your backend — reduces bandwidth and server load.
• Uploads are faster and more scalable.
• Backend still controls access (it issues the pre-signed URL and validates metadata, size, etc.).

• PUT: Use when you want a simple single-file upload.
• POST: Use when you need form-based uploads and constraints (e.g., content-type, file size limits).

​

Example commands and code

aws s3 presign s3://my-bucket/path/to/object --expires-in 3600

import boto3

s3 = boto3.client('s3')
url = s3.generate_presigned_url(
    ClientMethod='get_object',
    Params={'Bucket': 'my-bucket', 'Key': 'path/to/object'},
    ExpiresIn=3600  # seconds
)
print(url)

from boto3.s3.transfer import S3Transfer
import boto3

s3 = boto3.client('s3')
post = s3.generate_presigned_post(
    Bucket='my-bucket',
    Key='uploads/${filename}',           # allow client to fill filename
    Fields={'acl': 'private'},
    Conditions=[["content-length-range", 1, 10485760]],  # up to 10 MB
    ExpiresIn=3600
)
# Return `post` dict (url + fields) to the browser to perform a form POST.

import { S3Client, PutObjectCommand } from "@aws-sdk/client-s3";
import { getSignedUrl } from "@aws-sdk/s3-request-presigner";

const client = new S3Client({ region: "us-east-1" });

async function generatePresignedPut(bucket, key, expiresIn = 3600) {
  const command = new PutObjectCommand({ Bucket: bucket, Key: key });
  const url = await getSignedUrl(client, command, { expiresIn });
  return url;
}

​

Key points and constraints

​

How pre-signed URLs work (brief)

• The URL contains a signature, timestamp, and other metadata. S3 validates this signature on each request.
• The signature is computed using the signing identity’s credentials (long-term keys or temporary STS tokens).
• The allowed HTTP method and optional headers are encoded into the signature; requests that do not match the signed parameters are rejected.
• Anyone with the URL may use it until it expires — treat pre-signed URLs as sensitive secrets and rotate or revoke access by invalidating credentials or changing object keys if necessary.

​

Security best practices

• Use the principle of least privilege for the identity that creates pre-signed URLs.
• Keep URL expirations as short as practical for the use case.
• Validate uploaded content server-side if you rely on file type, size or metadata for downstream processing.
• Prefer pre-signed POST with conditions when you need to restrict fields (content-type, filename prefixes, max size).
• If you must revoke access immediately, rotate the IAM credentials used to sign URLs or change the object key/location.

​

Summary

1. Pre-signed URLs let you grant time-limited download or upload access to S3 objects without making the bucket public or creating AWS accounts for recipients.
2. Requests using a pre-signed URL are executed with the identity and permissions of the URL generator.
3. A generated pre-signed URL cannot grant access beyond the generating identity’s permissions; if the creator lacks access, the URL will fail.

​

References

• AWS S3: Share an object using a presigned URL — https://docs.aws.amazon.com/AmazonS3/latest/userguide/ShareObjectPreSignedURL.html
• AWS STS (temporary credentials) — https://docs.aws.amazon.com/STS/latest/UsingSTS/Welcome.html
• AWS CLI s3 presign — https://docs.aws.amazon.com/cli/latest/reference/s3/presign.html