Key Security Pitfalls to Avoid When Using AWS S3 Presigned URLs

AWS S3 presigned URLs are time-limited signed links that grant temporary access to specific S3 operations without exposing account credentials, but misconfiguration can create serious security risks. Setting excessively long expiration windows — up to the seven-day CLI maximum — is dangerous because a leaked URL remains valid until it expires, with no way to rotate it after the fact. URLs signed using temporary credentials, such as those from STS AssumeRole or EC2 instance profiles, will expire when the underlying session ends regardless of the requested duration. AWS recommends enforcing HTTPS via bucket policy, restricting signature age, and always generating URLs with short, explicit expiration times suited to the actual use case. Best practices also include signing with temporary IAM role credentials rather than long-term access keys to limit exposure if a URL is compromised.