Stop Uploading Files Through Your Backend: Use S3 Presigned URLs
A practical guide to using Amazon S3 presigned URLs for secure, scalable file uploads without routing large files through your backend. Learn how temporary access, private buckets, and direct-to-S3 uploads can simplify application architecture.
When building applications that allow users to upload images, PDFs, videos, or other files, a common approach is:
Client → Backend → S3
It works, but your backend becomes responsible for handling the entire file transfer.
A better pattern for many applications is:
Client → Backend → Presigned URL → S3
What Is a Presigned URL?
An Amazon S3 presigned URL provides temporary access to a specific S3 operation without giving the client AWS credentials.
Your backend generates the URL, and the client uses it directly with S3.
For example:
1
2
3
4
5
6
7
8
9
User
↓
Backend
↓
Generate Presigned URL
↓
Client
↓
S3Why Use It?
The backend doesn't have to stream the entire file.
This can reduce unnecessary load on your application server and makes direct-to-S3 uploads much easier to implement.
Presigned URLs can be created for operations such as:
PUT→ UploadGET→ DownloadHEAD→ Read object metadata
The URL can also have an expiration time.
The Important Security Rule
A presigned URL is not a replacement for authentication.
Anyone who obtains a valid URL can use it for the permitted operation until it expires.
So applications should:
- Keep S3 buckets private where appropriate
- Generate URLs only for authorized users
- Use short expiration periods when practical
- Restrict the IAM permissions of the signing identity
- Validate filenames and upload requirements
AWS also recommends avoiding unnecessary public access to S3 data.
The Pattern
1
2
3
4
5
6
7
8
9
10
11
12
13
Frontend
│
│ Request upload
▼
Backend
│
│ Generate signed URL
▼
Frontend
│
│ PUT file
▼
Amazon S3This simple pattern is useful for everything from profile images to large document uploads.
Final Takeaway
Don't automatically make your backend the middleman for every file.
For many applications, presigned URLs + private S3 buckets provide a cleaner architecture for securely moving files between users and S3.
AWS documentation: S3 Presigned URLs
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article