How to Use Presigned URL in S3 on AWS: Simple Guide

Use generate_presigned_url method from AWS SDK to create a temporary URL for S3 objects. This URL allows anyone with it to access the file without AWS credentials for a limited time.

Syntax

The generate_presigned_url method requires specifying the S3 operation, bucket name, object key, and expiration time. It returns a URL string that grants temporary access.

• Client: AWS S3 client object
• ClientMethod: Operation like get_object or put_object
• Params: Dictionary with Bucket and Key of the object
• ExpiresIn: Time in seconds the URL is valid

python

presigned_url = s3_client.generate_presigned_url(
    ClientMethod='get_object',
    Params={'Bucket': 'my-bucket', 'Key': 'my-file.txt'},
    ExpiresIn=3600
)

Example

This example shows how to create a presigned URL to download a file from S3 valid for 1 hour using Python and boto3.

python

import boto3

s3_client = boto3.client('s3')

url = s3_client.generate_presigned_url(
    ClientMethod='get_object',
    Params={'Bucket': 'example-bucket', 'Key': 'example.txt'},
    ExpiresIn=3600
)

print('Presigned URL:', url)

Output

Presigned URL: https://example-bucket.s3.amazonaws.com/example.txt?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=...

Common Pitfalls

• Using expired URLs: The URL stops working after ExpiresIn seconds.
• Wrong bucket or key names cause errors or invalid URLs.
• Not setting correct permissions on the bucket or object can block access even with a presigned URL.
• Using presigned URLs for sensitive data without HTTPS risks exposure.

python

import boto3

s3_client = boto3.client('s3')

# Wrong: Missing 'Key' parameter
# url = s3_client.generate_presigned_url(ClientMethod='get_object', Params={'Bucket': 'my-bucket'}, ExpiresIn=3600)

# Correct:
url = s3_client.generate_presigned_url(
    ClientMethod='get_object',
    Params={'Bucket': 'my-bucket', 'Key': 'file.txt'},
    ExpiresIn=3600
)

print(url)

Quick Reference

Remember these key points when using presigned URLs:

• Use generate_presigned_url with correct bucket and key.
• Set ExpiresIn to control URL lifetime.
• Ensure S3 permissions allow access via presigned URL.
• Use HTTPS to keep URLs secure.

Key Takeaways

Presigned URLs grant temporary access to S3 objects without AWS credentials.

Always specify correct bucket, key, and expiration time when generating URLs.

Expired URLs will no longer work and must be regenerated.

Ensure your S3 bucket and object permissions allow access via presigned URLs.

Use HTTPS to protect presigned URLs from interception.