A Pre-Signed URL is a temporary URL that grants time-limited access to a private S3 object — without making the bucket public.

The user who uses the URL inherits the permissions of the person who generated it.

How It Works

Owner (has S3 access)
    --> generates pre-signed URL
    --> shares URL with user

User
    --> accesses URL
    --> gets temporary access to the private object
    --> URL expires --> access gone

Expiration Times

Method Minimum Maximum
S3 Console 1 minute 720 minutes (12 hours)
AWS CLI 1 second 604800 seconds (7 days)

How to Generate

Via CLI:

aws s3 presign s3://bucket-name/object-key --expires-in 3600

Via SDK (Python):

url = s3_client.generate_presigned_url(
    'get_object',
    Params={'Bucket': 'my-bucket', 'Key': 'my-file.pdf'},
    ExpiresIn=3600
)

Use Cases

Premium content: User logs in → app generates a pre-signed URL → user downloads the file → URL expires automatically.

Temporary file sharing: Generate a URL valid for 2 hours, send to a client, access stops after expiry.

User uploads: Generate a pre-signed URL for a PUT operation → user uploads directly to your private S3 bucket without going through your server.