Working with presigned URLs
You can use presigned URLs to grant time-limited access to objects in Amazon S3 without updating your bucket policy. A presigned URL can be entered in a browser or used by a program to download an object. The credentials used by the presigned URL are those of the Amazon user who generated the URL.
You can also use presigned URLs to allow someone to upload a specific object to your Amazon S3 bucket. This allows an upload without requiring another party to have Amazon security credentials or permissions. If an object with the same key already exists in the bucket as specified in the presigned URL, Amazon S3 replaces the existing object with the uploaded object.
You can use the presigned URL multiple times, up to the expiration date and time.
When you create a presigned URL, you must provide your security credentials, and then specify the following:
-
An Amazon S3 bucket
-
An object key (if downloading this object will be in your Amazon S3 bucket, if uploading this is the file name to be uploaded)
-
An HTTP method (
GET
for downloading objects orPUT
for uploading) -
An expiration time interval
Currently, Amazon S3 presigned URLs don't support using the following data-integrity checksum algorithms (CRC32, CRC32C, SHA-1, SHA-256) when you upload objects. To verify the integrity of your object after uploading, you can provide an MD5 digest of the object when you upload it with a presigned URL. For more information about object integrity, see Checking object integrity.
Topics
Who can create a presigned URL
Anyone with valid security credentials can create a presigned URL. But for someone to successfully access an object, the presigned URL must be created by someone who has permission to perform the operation that the presigned URL is based upon.
The following are the types of credentials that you can use to create a presigned URL:
-
IAM instance profile – Valid up to 6 hours.
-
Amazon Security Token Service – Valid up to maximum 36 hours when signed with long-term security credentials or the duration of the temporary credential, whichever ends first.
-
IAM user – Valid up to 7 days when you're using Amazon Signature Version 4.
To create a presigned URL that's valid for up to 7 days, first delegate IAM user credentials (the access key and secret key) to the method you're using to create the presigned URL.
Note
If you created a presigned URL using a temporary credential, the URL expires when the credential expires. In general, a presigned URL expires when the credential you used to create it is revoked, deleted, or deactivated. This is true even if the URL was created with a later expiration time. For temporary security credentials lifetimes, see Comparing Amazon STS API operations in the IAM User Guide.
Expiration time for presigned URLs
A presigned URL remains valid for the period of time specified when the URL is generated. If you create a presigned URL with the Amazon S3 console, the expiration time can be set between 1 minute and 12 hours. If you use the Amazon CLI or Amazon SDKs, the expiration time can be set as high as 7 days.
If you created a presigned URL by using a temporary token, then the URL expires when the token expires. In general, a presigned URL expires when the credential you used to create it is revoked, deleted, or deactivated. This is true even if the URL was created with a later expiration time. For more information about how the credentials you use affect the expiration time, see Who can create a presigned URL.
Amazon S3 checks the expiration date and time of a signed URL at the time of the HTTP request. For example, if a client begins to download a large file immediately before the expiration time, the download continues even if the expiration time passes during the download. However, if the connection drops and the client tries to restart the download after the expiration time passes, the download fails.
Limiting presigned URL capabilities
The capabilities of a presigned URL are limited by the permissions of the user who created it. In essence, presigned URLs are bearer tokens that grant access to those who possess them. As such, we recommend that you protect them appropriately. The following are some methods that you can use to restrict the use of your presigned URLs.
Amazon Signature Version 4 (SigV4)
To enforce specific behavior when presigned URL requests are authenticated by using
Amazon Signature Version 4 (SigV4), you can use condition keys in bucket policies and
access point policies. For example, the following bucket policy uses the
s3:signatureAge
condition to deny any Amazon S3 presigned URL request on
objects in the
bucket if the signature is more than
10 minutes old. To use this example, replace the amzn-s3-demo-bucket1
with your own information.user input
placeholders
{ "Version": "2012-10-17", "Statement": [ { "Sid": "Deny a presigned URL request if the signature is more than 10 min old", "Effect": "Deny", "Principal": {"AWS":"*"}, "Action": "s3:*", "Resource": "arn:aws-cn:s3:::
amzn-s3-demo-bucket1
/*", "Condition": { "NumericGreaterThan": { "s3:signatureAge":600000
} } } ] }
For more information about policy keys related Amazon Signature Version 4, see Amazon Signature Version 4 Authentication in the Amazon Simple Storage Service API Reference.
Network path restriction
If you want to restrict the use of presigned URLs and all Amazon S3 access to particular network paths, you can write Amazon Identity and Access Management (IAM) policies. You can set these policies on the IAM principal that makes the call, the Amazon S3 bucket, or both.
A network-path restriction on the IAM principal requires the user of those credentials to make requests from the specified network. A restriction on the bucket or access point requires that all requests to that resource originate from the specified network. These restrictions also apply outside of the presigned URL scenario.
The IAM global condition key that you use depends on the type of endpoint. If you're
using the public endpoint for Amazon S3, use aws:SourceIp
. If you're using a
virtual private cloud (VPC) endpoint to Amazon S3, use aws:SourceVpc
or
aws:SourceVpce
.
The following IAM policy statement requires the principal to access Amazon only from
the specified network range. With this policy statement, all access must originate from
that range. This includes the case of someone who's using a presigned URL for Amazon S3. To use
this example, replace the
with your own information.user input
placeholders
{ "Sid": "NetworkRestrictionForIAMPrincipal", "Effect": "Deny", "Action": "*", "Resource": "*", "Condition": { "NotIpAddressIfExists": {"aws:SourceIp": "
IP-address-range
"}, "BoolIfExists": {"aws:ViaAWSService": "false"} } }