What is an S3 presigned URL and when would you use it?
A presigned URL is a temporary link, signed with someone's credentials, that lets a person upload or download one specific S3 object without having AWS credentials. It stops working when it expires.
Explain it simply
It is like a visitor pass at a company gate. The security desk (your app, with real access) prints a pass valid for one visitor, one room and two hours. The visitor needs no employee ID card, and after two hours the pass is useless.
Example
import boto3
s3 = boto3.client("s3")
url = s3.generate_presigned_url(
"get_object",
Params={"Bucket": "my-private-bucket", "Key": "invoices/inv-101.pdf"},
ExpiresIn=900, # 15 minutes
)
print(url) # share this link with the userThe bucket stays private. Anyone with the link can do exactly the action it was signed for (GET or PUT, on that key) until it expires. The URL carries the permissions of the identity that signed it, so if that identity loses access the link stops working too.
Common uses: letting a mobile app upload a profile photo straight to S3 instead of passing through your server, or giving a customer a short-lived download link for an invoice. Treat the link like a password and keep expiry short.
What to say in the interview
"A presigned URL grants temporary access to one object using the signer's permissions, with no AWS credentials for the user. I use it for direct browser uploads and private downloads, keep the expiry short, and keep the bucket itself private."
Common mistakes
- Making a bucket public instead of using presigned links.
- Setting very long expiry times.