Guides

S3 Presigned URL: Let Users Upload and Download Files Securely (CLI, Python, Node.js, Java)

By Ravindra Bagale, AWS & DevOps trainer · LinkedIn · Published: 16 October 2026 · Last updated: 17 October 2026

An S3 presigned URL is a time-limited link that lets someone download (GET) or upload (PUT) one specific object in a private bucket, without AWS credentials and without making the bucket public. Create a download link with aws s3 presign s3://bucket/file --expires-in 600, and create upload links in your backend with the SDK (generate_presigned_url in Python, getSignedUrl in Node.js). Keep the expiry short and the bucket's Block Public Access on.

# download link valid for 10 minutes
aws s3 presign s3://rb-invoices-2026/inv-1001.pdf --expires-in 600

# upload link (Python boto3), valid for 5 minutes
url = s3.generate_presigned_url("put_object",
    Params={"Bucket": "rb-uploads-2026", "Key": f"users/{user_id}/photo.jpg",
            "ContentType": "image/jpeg"}, ExpiresIn=300)

A live example first

A training institute stores student certificates (PDFs) in a private bucket, rb-certs-2026. A student should be able to download only their own certificate.

1. Try the plain object URL in a browser:

https://rb-certs-2026.s3.ap-south-1.amazonaws.com/2026/RB-1042.pdf
→ AccessDenied

Good. The bucket is private.

2. The backend creates a 10-minute link for this student only:

aws s3 presign s3://rb-certs-2026/2026/RB-1042.pdf --expires-in 600 --region ap-south-1

https://rb-certs-2026.s3.ap-south-1.amazonaws.com/2026/RB-1042.pdf?X-Amz-Algorithm=AWS4-HMAC-SHA256
&X-Amz-Credential=AKIA.../20261016/ap-south-1/s3/aws4_request&X-Amz-Date=20261016T190500Z
&X-Amz-Expires=600&X-Amz-SignedHeaders=host&X-Amz-Signature=8f2c...

3. The link opens the PDF. After 10 minutes the same link shows:

<Code>AccessDenied</Code><Message>Request has expired</Message>

Friends, the bucket never became public. The link carried a small, temporary permission for one file.

How does a presigned URL work?

Your backend has AWS credentials (ideally an IAM role). It signs the request details (method, bucket, key, expiry, and some headers) with those credentials, and puts the signature in the URL. When the user calls S3 with that URL, S3 checks the signature and the expiry, and checks that the signer is allowed to do that action. If the signer's role loses permission, the link stops working too.

How do I use presigned URLs step by step?

1. Keep Block Public Access on for the bucket.
2. Give your backend role only s3:GetObject / s3:PutObject on the needed prefix.
3. When a logged-in user asks, check they own that file.
4. Generate a URL for exactly that key, with a short expiry (5–15 minutes).
5. For browser uploads, add a CORS rule to the bucket.
6. After upload, validate the file (size, type) before using it.

Examples in each language

Python (boto3)

import boto3
s3 = boto3.client("s3", region_name="ap-south-1")
url = s3.generate_presigned_url("get_object",
        Params={"Bucket": "rb-certs-2026", "Key": "2026/RB-1042.pdf"}, ExpiresIn=600)

Node.js (AWS SDK v3)

import { S3Client, PutObjectCommand } from "@aws-sdk/client-s3";
import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
const s3 = new S3Client({ region: "ap-south-1" });
const url = await getSignedUrl(s3,
  new PutObjectCommand({ Bucket: "rb-uploads-2026", Key: `users/${userId}/photo.jpg`, ContentType: "image/jpeg" }),
  { expiresIn: 300 });

Java (AWS SDK v2)

S3Presigner presigner = S3Presigner.create();
GetObjectPresignRequest req = GetObjectPresignRequest.builder()
    .signatureDuration(Duration.ofMinutes(10))
    .getObjectRequest(b -> b.bucket("rb-certs-2026").key("2026/RB-1042.pdf"))
    .build();
String url = presigner.presignGetObject(req).url().toString();

.NET

var url = s3Client.GetPreSignedURL(new GetPreSignedUrlRequest {
    BucketName = "rb-certs-2026", Key = "2026/RB-1042.pdf",
    Expires = DateTime.UtcNow.AddMinutes(10), Verb = HttpVerb.GET });

Browser upload with the URL

await fetch(uploadUrl, { method: "PUT", headers: { "Content-Type": "image/jpeg" }, body: file });

The Content-Type must match what the backend signed, or you get SignatureDoesNotMatch.

CORS rule for browser uploads

[
  {
    "AllowedOrigins": ["https://ravindrabagale.com"],
    "AllowedMethods": ["PUT", "GET"],
    "AllowedHeaders": ["Content-Type"],
    "MaxAgeSeconds": 3000
  }
]

Add it in S3 → bucket → Permissions → Cross-origin resource sharing (CORS).

Limits and errors

The same idea on other clouds

Google Cloud Storage has signed URLs, and Azure Blob Storage has SAS tokens (shared access signatures). They all give short-lived, limited access without making storage public.

Real example: public buckets vs signed links

Many large data leaks have come from S3 buckets left public. For example, in 2017 security researchers at UpGuard reported that a public bucket used by a Verizon partner exposed records of millions of customers. Because of leaks like this, AWS turned on Block Public Access and disabled ACLs by default for all new buckets from April 2023. Presigned URLs are the safe way to share files while keeping those protections on.

Mistakes to avoid

1. Making the bucket public "just for downloads". Use presigned URLs.
2. Week-long links for private documents. Use minutes.
3. Letting users choose the full key. Build it on the server (users/<id>/...), or one user can overwrite another's file.

Summary table