How to Set Expiration for S3 Presigned URLs in AWS

Select Language:

If you’re using Amazon S3 presigned URLs, you should know that, by default, these URLs don’t have a built-in way to expire after just one use. They’re designed to stay valid for the amount of time you specify when creating them, which can be up to 7 days if you’re using the AWS command line or SDKs. These URLs can be used multiple times until they hit their expiration time.

To make these URLs more secure, there are a few strategies you can follow:

First, set the shortest possible expiration time for your needs. If you know it takes a certain amount of time to download a file, you can calculate and set an expiration just a little longer than that to reduce the window of opportunity for misuse.

Second, consider adding an extra layer of security within your application. You can implement a token-based system to keep track of each access attempt. When someone uses a presigned URL, invalidate the token immediately afterward to prevent a second use.

Third, you can enhance security further by using AWS Signature Version 4 (SigV4). This involves adding specific condition keys to your bucket policies, like “s3:signatureAge,” which limits the maximum time between when the signature is created and when it is used. This helps ensure URLs aren’t valid for longer than you prefer.

Fourth, to ensure the data stays intact during transfer, you can add a Content-MD5 checksum header to your request. This way, you can verify that files haven’t been altered or corrupted during upload or download.

Fifth, to protect against path traversal attacks, generate a unique identifier such as a UUID to replace the filename in the URL.

Lastly, follow the principle of least privilege by using a dedicated AWS Lambda function, with limited permissions, to generate your presigned URLs. This reduces the risk of unauthorized access.

If your application absolutely needs URLs that are only usable once, you will need to keep track of each URL usage through your application’s backend, like in a database. Alternatively, you could use AWS Lambda@Edge with an IAM role to access the S3 bucket directly, removing the need for presigned URLs altogether.

Another option to consider is switching from S3 presigned URLs to Amazon DynamoDB for object storage. DynamoDB doesn’t rely on URLs that expire, giving you more control over access.

By adopting these measures, you can better secure your data and control how your files are accessed.