Is using a presigned URL in 2025 safe enough to prevent malware and allow only images?

Using event notifications combined with AWS Lambda is the way to go. You can verify the contents of the files after they're uploaded. This approach allows you to tag the uploads as clean and apply a Deny policy on the S3 bucket for any files lacking this tag. It’s a straightforward and effective method!

Honestly, not much has changed since last time. AWS still doesn't validate the content during the upload. You can't completely trust the client to upload safe files. It's best to validate the files after they've been uploaded to prevent any malicious content from being accessed. Consider using AWS GuardDuty for scanning.

Presigned URLs alone won’t solve your security problems. You’ve got to analyze the files post-upload. Setting up an SQS queue to trigger a Lambda function can streamline the process and help you validate uploads effectively.

AWS GuardDuty has your back! It can scan uploaded files for malware, and you can set up your bucket with a policy that denies access to any files that don’t have a clean tag from GuardDuty. It gives you an extra layer of security while using presigned URLs.

You definitely need to validate the content after the upload. Presigned URLs are secure, but the real work of ensuring the uploaded content is safe falls on you. Make sure to implement your own checks.