S3 Presigned URL

Question 1

For what are pre-signed URLs used? What problem do they solve?

Answer 1

Provides temporal access to private resources without needing to make public a private bucket or give credentials or an AWS account to unknown users.

Question 2

Example or UC of presigned URL:

Answer 2

Users of applications do not need to have an IAM user, they can get access through the app and get access to read, download or upload objects to private buckets.

Question 3

What information is required to make a request to S3 to generate a presigned URL?

Answer 3

1. Security credentials
2. Bucket name
3. Object key
4. Expiry date and time
5. Indicate how the object will be accessed

Question 4

What information is encoded in the presigned URL?

Answer 4

The provided data upon creation.

1. Security credentials
2. Bucket name
3. Object key
4. Expiry date and time
5. Indicate how the object will be accessed

Question 5

What is the process to get a presigned URL? (mention steps)

Answer 5

1. Request to S3 to generate presigned URL
2. S3 returns the presigned URL
3. Presigned URL is shared with the unauthenticated user (in some way)
4. The user can upload or download (PUT or GET) data

Question 6

What access can a pre-signed URL provide?

Answer 6

Access to a bucket or specific objects

Question 7

Do pre-signed URLs make sense when using public buckets?

Answer 7

No, it is used normally to provide access to private buckets to unauthenticated resources

Question 8

Can you create a pre-signed URL for an object you do not have access to?

Answer 8

Yes, you can still get the pre-signed URL but the object will not allow access because the requestor’s user does not have access to it.

Question 9

Is it recommendable to generate presigned URLs using IAM roles and why?

Answer 9

It is not recommended because the role will likely expire before the URL does.
You should always use long term identities to generate URLs, generally IAM users.