S3 URL Signing Overview

An S3 signed URL includes additional information such as an expiration date and time that gives you more control over access to your content.

The additional information appears in a policy statement, which is based on either a canned policy or a custom policy:

Custom policy provides more flexibility over canned as it allows reuse the policy, and to specify date and time that users can begin to access and IP address or range of IP addresses of the users who can access, and includes a base64-encoded version of the policy.

Notes on Pre-Signed URLs

1. A pre-signed URL gives you access to the object identified in the URL.

2. If you receive a pre-signed URL to upload an object, you can upload the object only if the creator of the pre-signed URL has the necessary permissions to upload that object.

3. The pre-signed URLs are useful if you want your user/customer to be able upload a specific object to your private bucket, but you don't require them to have AWS security credentials or permissions.

4. When you create a pre-signed URL, you must provide your security credentials, specify a bucket name, an object key, an HTTP method (PUT for uploading objects), and an expiration date and time.

5. The pre-signed URLs are valid only for the specified duration.

6. You can generate a pre-signed URL programmatically using the AWS SDK for Java or .NET.

   1. If you are using Visual Studio, you can also use AWS Explorer to generate a pre-signed object URL without writing any code.

7. Anyone who receives a valid pre-signed URL can then programmatically upload an object.