What’s the best way to serve public product images stored in S3?
Asked by
MellowOrbit42
I've built a file-management microservice that uses the AWS SDK, and uploads are working through presigned URLs issued by my application backend. Now I need to display customer-uploaded product images in a catalog.
I'm unsure whether image downloads should also use presigned URLs. Since those URLs expire, they seem inconvenient for images that need to remain available, and routing every request through the microservice just to generate new read URLs could add unnecessary overhead.
Would it be better to keep the S3 bucket private and put CloudFront or another CDN in front of it, using cached public URLs? Or should the objects themselves be publicly readable? What setup is generally recommended for production, and how should the image list and URLs be managed?
Answers
CloudFront only serves the objects; it doesn’t automatically provide a catalog or listing system. Keep the object key, metadata, and image URL or URL pattern in your application database when the upload is created. The catalog endpoint can then return the product data along with its image URLs.
A custom domain is preferable, but CloudFront’s generated hostname also works. You can use another CDN if its pricing or global performance is better, but the important parts are stable cacheable URLs, a private origin, and an explicit access policy rather than repeatedly generating read URLs in the application.
Reply to this answer
For public product images, the usual AWS setup is a private S3 bucket behind CloudFront. Give CloudFront access through an Origin Access Control (OAC), and block all direct public access to the bucket. Uploads can continue using presigned PUT URLs, while downloads use stable CloudFront URLs such as `https://images.example.com/products/abc123.jpg`.
If the images are genuinely public, you don’t need signed URLs for downloads. CloudFront handles caching and protects the bucket from most direct traffic. Use signed CloudFront URLs or cookies instead if some images must be restricted.
Reply to this answer
Add your answer
Answers are reviewed before publication.
Related Discussions