What Is a Pre-signed URL?

A pre-signed URL is a time-limited, cryptographically signed link that grants temporary access to an S3 object. The person who generates the URL uses their AWS credentials to sign it; the person who uses the URL needs no AWS credentials at all.

Think of it like a guest pass. You own the building (the bucket) and have a key (your IAM credentials). Instead of giving everyone a copy of your key or leaving the door unlocked (making the bucket public), you issue a guest pass that expires. The guest pass proves you authorized access, works for a limited time, and can't be reused after it expires.

Key insight: The person clicking the pre-signed URL doesn't need an AWS account, IAM user, access key, or any AWS knowledge. The URL itself carries the authorization. This is how you share private objects without ever making your bucket public.

How Pre-signed URLs Work

When you create a pre-signed URL, the AWS SDK or CLI performs AWS Signature V4 signing using your credentials. The signature is embedded directly in the URL as query parameters. When S3 receives a request with a pre-signed URL, it validates:

1. The signature — does it match what the declared credentials would produce for this exact request?
2. The expiration — has the timestamp passed?
3. The permissions — was the signing principal actually authorized to perform this action on this object at the time the URL was generated?

No API call to IAM happens at access time. The signature and the timestamp are self-contained proof that someone with valid credentials authorized this specific operation.

Important nuance: S3 checks whether the signer had permission at the moment the URL is used, not when it was created. If the signer's IAM permissions are revoked before the URL expires, the URL stops working — even if the signature and expiration are still valid.

Pre-signed URL for GET (Download / Share)

The most common use case: you have a private object and you want to give someone temporary download access.

aws s3 presign s3://my-bucket/reports/q4-financials.pdf \
  --expires-in 3600

This generates a URL valid for 3,600 seconds (1 hour). Anyone with the URL can download q4-financials.pdf during that window. After it expires, S3 returns 403 Forbidden — the signature is no longer valid.

You can specify any duration up to 7 days (604,800 seconds) with Signature V4. If you need longer, you'd need to use Signature V2 (deprecated — don't use it).

Pre-signed URL for PUT (Upload)

You can also generate a pre-signed URL that allows someone to upload an object — without giving them write access to your bucket. This is commonly used for direct-to-S3 uploads from browsers or mobile apps: your backend generates the URL, the client uploads directly to S3.

However, aws s3 presign only generates GET URLs. For PUT pre-signed URLs, you need an AWS SDK:

# Python (boto3)
import boto3
url = boto3.client('s3').generate_presigned_url(
    'put_object',
    Params={'Bucket': 'my-bucket', 'Key': 'uploads/file.csv'},
    ExpiresIn=1800
)
print(url)

# Then the client uploads:
# curl -X PUT -T file.csv "PRESIGNED_URL"

CLI reality: aws s3 presign generates pre-signed GET URLs only. For PUT/POST pre-signed URLs, use an AWS SDK (boto3, JavaScript SDK, etc.). The lab in this lesson focuses on GET pre-signing — the most common and CLI-accessible pattern. PUT pre-signing is a natural next step when you build an application backend.

Anatomy of a Pre-signed URL

Here's what a pre-signed URL actually looks like (with annotations):

https://my-bucket.s3.ap-southeast-1.amazonaws.com/reports/q4.pdf
?X-Amz-Algorithm=AWS4-HMAC-SHA256
&X-Amz-Credential=AKIAIOSFODNN7EXAMPLE%2F20260730%2Fap-southeast-1%2Fs3%2Faws4_request
&X-Amz-Date=20260730T120000Z
&X-Amz-Expires=3600
&X-Amz-SignedHeaders=host
&X-Amz-Signature=6b6e0f9c3c1234567890abcdef1234567890abcdef1234567890abcdef

Security Considerations

Shared-responsibility trap: S3 enforces the signature and expiration. But if you email a pre-signed URL, post it in Slack, or log it to CloudWatch in plaintext — that's on you. Anyone who sees it can use it until it expires. Treat pre-signed URLs like passwords.

Pre-signed URLs vs. Making Objects Public

Lab: Pre-signed URLs for Private Object Sharing

You’ll create a private bucket, upload a sensitive file, generate a pre-signed URL, and verify it works — then watch it expire.

1. Create a private bucket

aws s3api create-bucket \
  --bucket learn-devops-presign-YOURNAME-0008 \
  --region ap-southeast-1 \
  --create-bucket-configuration LocationConstraint=ap-southeast-1

No bucket policy, no public access — this bucket is completely private.

2. Create a sample file with sensitive content

Createa a file called product-launch-brief.txt

CONFIDENTIAL — INTERNAL USE ONLY
Project: Q3 Product Launch
Revenue Target: $2.4M
Launch Date: 2026-09-15
Key Partners: Acme Corp, Globex Inc, Initech

3. Upload the file to the private bucket

aws s3 cp product-launch-brief.txt s3://learn-devops-presign-YOURNAME-0008/internal/product-launch-brief.txt

4. Confirm the object is private

Try accessing it directly via the REST endpoint:

curl -I https://learn-devops-presign-YOURNAME-0008.s3.ap-southeast-1.amazonaws.com/internal/product-launch-brief.txt

Alternatively, try your browser — you'll get an AccessDenied XML response. This is the correct behavior for a private object.

5. Generate a pre-signed URL (short expiration)

To generate the pre-signed URL use this command:

aws s3 presign s3://learn-devops-presign-YOURNAME-0008/internal/product-launch-brief.txt \
  --expires-in 120

The command outputs a URL starting with https://. It's valid for 2 minutes (120 seconds). Copy the URL.

6. Use the pre-signed URL immediately

Paste the URL into your browser, or use curl:

curl "PASTE_YOUR_PRESIGNED_URL"

You should see the confidential file content. No AWS credentials required — the URL itself proves you're authorized.

7. Inspect the URL structure

Break down the URL you generated. Identify each parameter from section 5:

• Find the X-Amz-Expires value — it should be 120
• Find the X-Amz-Credential — it contains your access key ID, date, region, and service
• Find the X-Amz-Signature — the long hex string at the end

8. Wait for expiration, then try again

Wait at least 2 minutes (the 120-second window). Then access the same URL again in your browser or with curl:

curl -I "PASTE_YOUR_EXPIRED_PRESIGNED_URL"

You should now get 403 Forbidden with a message like Request has expired. The URL is dead — the guest pass has been revoked by time.

9 Experiment: Tamper with a pre-signed URL

Generate a fresh pre-signed URL (120 second expiration). Before it expires:

1. Copy the URL.
2. Change one character in the object key (e.g., product-launch-brief.txt → product-launch-briefX.txt).
3. Try to access the modified URL.

# Example: access with a deliberately corrupted URL
curl -I "MODIFIED_URL"

Result: 403 SignatureDoesNotMatch. The signature cryptographically binds the URL to the exact key — any modification invalidates it.

10 Generate a longer-lived URL and test

aws s3 presign s3://learn-devops-presign-YOURNAME-0008/internal/product-launch-brief.txt \
  --expires-in 604800

This generates a URL valid for 7 days — the maximum. Verify it works, then mentally note: anyone who gets this URL in the next week can download this file. This is why short expirations matter.

11 Cleanup

aws s3 rm s3://learn-devops-presign-YOURNAME-0008/ --recursive
aws s3api delete-bucket --bucket learn-devops-presign-YOURNAME-0008

Mission connection: In your backup project, pre-signed URLs let your backup validation system share verification reports with stakeholders without making the reports bucket public. In your static site project, you can use pre-signed URLs for gated content — share premium downloads, private documents, or internal assets without exposing them to the internet. Pre-signed URLs are the bridge between "everything is private" and "only the right people get access."

Common Pre-signed URL Patterns

Primary Sources

• S3 User Guide — Working with pre-signed URLs
• S3 User Guide — Uploading objects using pre-signed URLs (PUT/POST patterns)
• S3 API Reference — Signature V4 query string authentication (how the signing works under the hood)
• AWS CLI Command Reference — s3 presign