AWS Builder Center

Builder Center

Share a private S3 file without making the bucket public

A short hands-on lab with the AWS CLI: create a private S3 bucket, check that anonymous access is denied, and share one file with a presigned URL that expires after 60 seconds.

Share a private S3 file without making the bucket public

A common beginner mistake is making an S3 bucket public just to share one file. You don't need to. A presigned URL gives temporary access to a single object while the bucket stays private. In this lab we create one with the AWS CLI and watch it expire.
The only thing created is one tiny object, and we delete it at the end.

Step 1: Create a private bucket

1
2
3
BUCKET=presign-lab-$RANDOM$RANDOM
aws s3 mb s3://$BUCKET --region eu-west-1
aws s3api get-public-access-block --bucket $BUCKET
The last command should show all four settings as true. New buckets block public access by default.

Step 2: Upload a file

1
2
echo "hello from a private bucket" > note.txt
aws s3 cp note.txt s3://$BUCKET/

Step 3: Check that it is private

1
2
curl -s -o /dev/null -w "%{http_code}\n" \
https://$BUCKET.s3.eu-west-1.amazonaws.com/note.txt
The answer is 403. Anonymous requests are denied.

Step 4: Create a presigned URL

1
2
URL=$(aws s3 presign s3://$BUCKET/note.txt --expires-in 60 --region eu-west-1)
curl "$URL"
This time you get the file content. Wait one minute and run curl "$URL" again: S3 returns AccessDenied because the URL has expired.

How it works

The CLI doesn't contact S3 to create the URL. It signs the request locally with your credentials and puts the signature and the expiry time in the query string. S3 then treats whoever opens the link as you, for that one object and that one action.
Three things to remember:
  • The URL is a secret. Anyone who has it can download the file until it expires.
  • Keep the expiry short. The default is 3600 seconds and the maximum is 7 days.
  • If you signed it with temporary credentials, the URL stops working when those credentials expire, even if the expiry time is longer.

Step 5: Clean up

1
aws s3 rb s3://$BUCKET --force
The bucket was never public, and the link no longer works. That is the whole point: share the object, not the bucket.
Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.
Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article