Amazon S3 presigned URL security
summary
Presigned URLs are S3-specific signed GET/PUT requests that pack signature data into query parameters and use X-Amz-Expires to set lifetime (example 300 = five minutes); they permit a single exact operation (no multipart or altered headers) and never outlive the signing credential, so revocation requires rotating keys or changing the signer’s permissions. They are bearer tokens and replayable for their duration. Alternatives include CloudFront signed cookies for many files, request-proxy signing, and S3 Access Grants (token vending usable with AWS Identity Center).
AI-written summary · about
chapters (10)
- 0:00Introduction to S3
- 1:09AWS authentication basics
- 3:26Understanding pre-signed URLs
- 5:51How to use pre-signed URLs
- 8:15When to use pre-signed URLs
- 10:19Risks of pre-signed URLs
- 13:27Best practices for security
- 16:11Cloudfront and proxies
- 18:04S3 access grants
- 19:04Summary and conclusion
related talks
26mProtecting your data in Amazon S3
38mSecuring Amazon S3 with guardrails and fine-grained access controls
45mAmazon S3 encryption and access control best practices
01h 03m3 innovations that redefine data protection for Amazon S3
19mManaging access to your Amazon S3 buckets and objects
32mREST security essentials
07m15 years of Amazon S3 - Security is Job Zero
17mS3 Object Lambda - add code to Amazon S3 GET requests to process data