Lend a file, not the whole bucket — S3 and Presigned URLs

Your goal

Let a teammate download one private file through a temporary link.

Why this matters

A teammate needs a report, but making your whole bucket public would share too much. You will choose a narrow link, set its lifetime, and handle it like a temporary key.

Words you will use

A presigned URL is a link with a signature that grants a specific request. The signer supplies the permission. Expiration is when the link stops being valid.

How to proceed

Read each situation and choose an answer. The lesson explains the result. Try again if needed, then continue through all three decisions and finish the tour.

1. Share just one report

Your private bucket contains reports for many teams. Sam needs to download only team-a.pdf. Choose an approach that leaves the other files private.

Which sharing method fits?

Create a presigned download URL for team-a.pdf.

A presigned URL authorizes a particular request using the signer’s credentials. The signer must already be allowed to read that file. It does not need to open the entire bucket.

Sam gets a download path for the intended report.

GET team-a.pdf → signed URL → authorized download

2. Choose a useful lifetime

Sam needs the link for a short meeting. You are choosing when access should end. The signing credentials might expire before the link’s requested lifetime.

What should you expect?

Access ends when the link or its credentials expire.

Use a short lifetime that fits the task. Temporary credentials can end access earlier than the requested expiration. Do not promise that a chosen duration overrides the signer’s own limits.

The meeting has a bounded access window.

Usable lifetime ≤ link expiry and credential lifetime

3. Treat the link as a key

Sam considers posting the link in a public chat. A second person could copy it while it is valid. Choose advice that matches how this link works.

Who should receive the link?

Only intended recipients through a suitable private channel.

Anyone who has a valid link may be able to use it. Presigned URLs are not automatically single-use. Keep the link private and avoid putting it in public logs or messages.

The team handles the temporary link as a temporary secret.

Share privately → use within lifetime → let access expire

Practice, then check your understanding

In the interactive tour, make each decision before seeing the outcome. Wrong answers receive coaching, and replay gives you a fresh attempt without duplicating earned XP.

Read the official AWS documentation for service behavior and production details.