My backend generates presigned upload URLs using temporary AWS credentials. If the URL's signature has not expired yet, can the STS session still cause the upload to fail?
Can an S3 presigned URL expire before its stated expiry because of an STS token?
Asked by
f720~ioport_3
Answers
Yes. A URL signed with temporary credentials stops working when those credentials expire, even if X-Amz-Date plus X-Amz-Expires says there is more time left. Refreshing the backend's credentials does not extend URLs it already signed.
For example, if the credentials have 15 minutes remaining when you sign a URL for an hour, the URL can work for at most those 15 minutes. Other permission changes can also make it fail sooner.
Reply to this answer
For an upload that may wait a long time, consider requesting a fresh URL when the client is ready to upload rather than issuing it when the upload is queued. That avoids needing the original URL and signing session to stay valid throughout the wait.
If you do return an expiry time to the client, base it on the earlier of the requested URL expiry and the signing credentials' expiration. Treat that as an upper bound, not a guarantee.
Reply to this answer
Longer-lived IAM user credentials are another option for signing URLs, but they need careful protection and narrowly scoped permissions. They avoid the temporary session limit, not every limit. Signature Version 4 presigned URLs have a maximum expiry of seven days.
CloudFront signed requests are another option mentioned for longer-lived access, though that is a different design and needs to be evaluated for the upload flow.
Reply to this answer
Add your answer
Answers are reviewed before publication.
f720~ioport_3:
So checking only the expiry parameters in the URL can tell me it has expired, but not guarantee that it's still usable?
n53!clk_2:
Right. The URL carries a security token, but its credential expiration is not exposed as a simple expiry field you can rely on parsing from the URL.