Secure Temporary File Sharing in AWS S3 with pre-signed URLs: A Hands-On Guide

Why Presigned URLs Matter in the Real World
Imagine you're building a healthcare app where doctors need to securely access patient lab reports stored in a private S3 bucket. You don’t want to make the bucket public, but you need to grant time-limited access to specific files. Presigned URLs solve this by generating temporary, expiring links that authorize access to private S3 objects. Other use cases:

Sharing confidential documents with clients.
Distributing time-sensitive media (e.g., concert recordings).
Allowing users to download purchased software securely.

How to Grant Users Access to S3 Objects

By default, all objects stored in Amazon S3 are private, meaning only the owner of the bucket has access to them. However, if you need to grant users access to specific buckets or objects without making them publicly available, you can do so by assigning the appropriate permissions through an IAM policy. Alternatively, you can use presigned URLs to provide temporary access without requiring users to have AWS credentials or IAM permissions.

So Why to use Presigned URLs?

A presigned URL is a time-limited URL that grants temporary access to a specific S3 object. These URLs allow users to either read or write (update) an object, depending on the permissions you configure. The URL includes specific parameters set by your application, ensuring controlled and secure access. These parameters include:

Bucket: The name of the bucket where the object is stored (or will be stored).
Key: The name or path of the object.
Expires: The duration for which the URL remains valid.

Once the expiration time passes, the URL becomes invalid, and the user can no longer access the object. Importantly, presigned URLs are securely signed by the S3 bucket owner, ensuring that only authorized users can interact with the object during the specified time frame.

Project Lab: Create and Test Presigned URLs
Objective: Build a system to share private S3 objects securely and temporarily using pre-signed URLs.

Prerequisites:

Prerequisites for Using `aws s3 cp`

AWS CLI Installed:
The AWS Command Line Interface (CLI) must be installed on your machine.

Installation instructions: AWS CLI Installat ion Guide.

Verify installation:

  # Run to verify AWS CLI is installed 
  aws --version

  # Configure AWS CLI with AWS Credential and Default Region. 
  aws configure

You’ll be prompted for:
- AWS Access Key ID: Your IAM user’s access key.
- AWS Secret Access Key: Your IAM user’s secret key.
- Default Region Name: The AWS region (e.g., us-east-1).
- Default Output Format: Optional (e.g. jason)

Verify configuration:

  cat ~/.aws/credentials  
  cat ~/.aws/config

Step 1: Create an S3 Bucket and Upload a Test File

Create a private S3 bucket:

 aws s3api create-bucket --bucket your-unique-bucket-name --region us-east-1

Upload a sample file (e.g., medical-report.pdf):

 echo "Confidential Patient Data" > medical-report.pdf  
 aws s3 cp medical-report.pdf s3://your-unique-bucket-name/

Step 2: Generate a Presigned URL via AWS CLI

Generate a URL that expires in 5 minutes (300 seconds):

aws s3 presign s3://your-unique-bucket-name/medical-report.pdf --expires-in 300

https://your-unique-bucket-name.s3.amazonaws.com/medical-report.pdf?AWSAccessKeyId=...&Signature=...&Expires=...

Step 3: Generate a Presigned URL with Python (Boto3)

Install Boto3:
```
 pip install boto3
```

Python script (generate_presigned_url.py):

 import boto3  
 from datetime import timedelta  

 s3_client = boto3.client('s3')  

 url = s3_client.generate_presigned_url(  
     ClientMethod='get_object',  
     Params={  
         'Bucket': 'your-unique-bucket-name',  
         'Key': 'medical-report.pdf'  
     },  
     ExpiresIn=300  # 5 minutes  
 )  

 print("Presigned URL:", url)

Run the script:
```
 python generate_presigned_url.py
```
When you run the script, it will generate a presigned URL that looks something like this:

plaintext

Copy
```
 Presigned URL: https://your-unique-bucket-name.s3.amazonaws.com/medical-report.pdf?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIOSFODNN7EXAMPLE%2F20231015%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20231015T123456Z&X-Amz-Expires=300&X-Amz-SignedHeaders=host&X-Amz-Signature=1a2b3c4d5e6f7g8h9i0j1k2l3m4n5o6p7q8r9s0t1u2v3w4x5y6z7a8b9c0d
```
What Does This Mean?
- URL Structure: The URL points to the medical-report.pdf file stored in the your-unique-bucket-name S3 bucket.
- Temporary Access: The URL is valid for 5 minutes (as specified by ExpiresIn=300).
- Security: The URL includes a signature (X-Amz-Signature) and other parameters that ensure only authorized users can access the file during the specified time frame.

How to Use the URL

Copy the pre-signed URL and share it with the intended user.
The user can open the URL in a web browser or use it in a tool like curl or wget to download the file.
After 5 minutes, the URL will expire, and access to the file will be revoked.

Step 4: Test URL Expiration

Generate a URL with a 10-second expiration:

 aws s3 presign s3://your-unique-bucket-name/medical-report.pdf --expires-in 10

Wait 15 seconds and try accessing the URL. You’ll see an HTTP 403 Forbidden error.

Step 5: Security Best Practices

Short Expiration Times: Use 5-15 minutes for most cases.
HTTPS Only: Always generate presigned URLs with HTTPS.

Restrict IAM Policies: Limit the IAM user/role to only s3:GetObject permissions.

 {  
     "Version": "2012-10-17",  
     "Statement": [{  
         "Effect": "Allow",  
         "Action": "s3:GetObject",  
         "Resource": "arn:aws:s3:::your-unique-bucket-name/*"  
     }]  
 }

Conclusion
Presigned URLs are a powerful way to securely share private S3 objects without exposing your bucket to the public. By following this guide, you’ve learned to generate URLs via CLI and SDK, test their expiration, and apply security best practices. Use this for secure document sharing, time-bound downloads, or even temporary access in serverless apps!

For more information and reference on this, please follow

I hope this Blog helps you understand Amazon S3 Presigned URLs' capabilities and gives you insights into the amazing new ways to share Temporary Files with Amazon S3 Objects.

For more information on this, please follow Working with Mountpoint for Amazon S3

Thank you for the read. Hope you like it.
I appreciate your time.

Follow for more Azure and AWS Content. Happy Learning!

Regards,
Jineshkumar Patel

Secure Temporary File Sharing in AWS S3 with pre-signed URLs: A Hands-On Guide

Comments

More from this blog

Agent Plugins for AWS

Understanding AWS Storage Gateway: A Practical Guide to Hybrid Cloud Storage

AZ-104: Manage Azure Identities and Governance — Complete Study Guide for Microsoft Azure Administrators

Mastering Target Tracking Scaling Policies for Amazon EC2 Auto Scaling

Attach an EBS volume to multiple EC2 instances using Multi-Attach

How to Grant Users Access to S3 Objects

So Why to use Presigned URLs?

Prerequisites for Using `aws s3 cp`

Step 1: Create an S3 Bucket and Upload a Test File

Step 2: Generate a Presigned URL via AWS CLI

Step 3: Generate a Presigned URL with Python (Boto3)

How to Use the URL

Step 4: Test URL Expiration

Step 5: Security Best Practices

Command Palette

Comments

More from this blog

How to Grant Users Access to S3 Objects

So Why to use Presigned URLs?

Prerequisites for Using aws s3 cp

Step 1: Create an S3 Bucket and Upload a Test File

Step 2: Generate a Presigned URL via AWS CLI

Step 3: Generate a Presigned URL with Python (Boto3)

How to Use the URL

Step 4: Test URL Expiration

Step 5: Security Best Practices

Prerequisites for Using `aws s3 cp`