/// FEATURES / FILES & PRESIGNED URLS
Files & Presigned URLs
Generate time-limited presigned URLs to share S3 objects securely without making them public.
What are presigned URLs?
A presigned URL is a time-limited, pre-authenticated URL that grants temporary access to a specific S3 object. Anyone with the URL can download the object directly from S3 — no AWS credentials required. The URL encodes an expiry time and a cryptographic signature generated from your AWS credentials. Once the URL expires, it stops working automatically.
Presigned URLs are the standard way to share private S3 objects without changing bucket ACLs or making objects public. They are widely used for download links, email attachments, and API responses that need to serve file content.
Generating presigned URLs
To generate a presigned URL in storafleet, open the file browser for any bucket, hover over the object you want to share, and click the Share action. Select your desired expiry duration and clickGenerate URL. The URL is copied to your clipboard automatically and is ready to share.
You need s3:GetObject permission on the object to generate a presigned URL. The URL is signed using the AWS Signature Version 4 algorithm via the AWS SDK.
Expiry options
storafleet supports the following presigned URL expiry durations:
- 15 minutes — for highly sensitive, short-lived access
- 1 hour — default, suitable for most sharing use cases
- 24 hours — for links shared in emails or documents
- 7 days — the maximum allowed by AWS for IAM user credentials
Note that AWS enforces a maximum presigned URL lifetime of 7 days when using IAM user credentials. If you are using temporary credentials from an IAM role or STS, the URL cannot outlive the credential session.
Security considerations
Presigned URLs are as sensitive as the objects they point to. Anyone who obtains the URL can access the object until it expires. Do not share presigned URLs in public channels or embed them in client-side JavaScript. Use the shortest expiry that satisfies your use case. If a URL is accidentally exposed, you cannot revoke it early — but you can delete the object or rename it to invalidate the URL's path.