Generating presigned URL for S3 object agent

Edit online

By default, all S3 objects are private and only the object owner has permission to access them. However, the object owner may share objects with others by creating a presigned URL. A presigned URL uses security credentials to grant time-limited permission to download objects. The URL can be entered in a browser or used by a program to download the object. The credentials that are used by the presigned URL are those of the S3 user who generated the URL.

You can use presigned URLs to grant time-limited access to objects in S3 without updating your bucket policy.

When you create a presigned URL, you must provide your security credentials, and then specify the following:
  1. S3 bucket
  2. An object key: for downloading this object will be in your S3 bucket
  3. An HTTP method: GET for downloading objects
  4. An expiration time interval: this is optional and the default time is 3600 seconds
Note: The object agent do not support presigned URL for object uploading.

Examples

When the object agent is configured by using self-signed certificate, see the following examples:
Note: When the object agent is configured with a CA signed certificate, you do not need to use --no-verify-ssl option.
  • To list objects of the testbucket bucket:
    aws s3 --no-verify-ssl --endpoint-url=<host_URL>:9000 ls s3://testbucket
    Output:
    2024-08-29 21:13:08 99 file1
2024-08-29 21:13:55 99 file2
2024-08-29 21:14:07 99 file3
  • To generate presigned URL of the file1 object:
    aws s3 --no-verify-ssl --endpoint-url=<host_URL>:9000 presign s3://testbucket/file1
    Output:
    <host_URL>:9000/testbucket/file1?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=XXXXus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240830T103740Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&X-Amz-Signature=5a2a69a49aa23e93ed15f40157083fa2ee3ad086083176257e2eb578789cb396
  • To download data of the file1 object by using presigned URL:
    curl -k "<host_URL>:9000/testbucket/file1?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=7A3TSE2BZY8TQPBY3ALO%2F20240830%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240830T103740Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&X-Amz-Signature=5a2a69a49aa23e93ed15f40157083fa2ee3ad086083176257e2eb578789cb396" -o fileOutput
    Output:
     % Total % Received % Xferd Average Speed Time Time Time Current
 Dload Upload Total Spent Left Speed
100 249 100 249 0 0 2263 0 --:--:-- --:--:-- --:--:-- 2263
  • To verify data content of the file1 object:
    cat fileOutput
    Output:
    Hello World
  • To create a presigned URL with a custom duration that links to an object in an S3 bucket:
    • The following presign command generates a presigned URL for the testbucket bucket and the file1 key that is valid for five hours:
      aws s3 --no-verify-ssl --endpoint-url=<host_URL>:9000 presign s3://testbucket/file1 --expires-in 18000
      Output:
      <host_URL>:9000/testbucket/file1?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=XXXX%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20241130T161600Z&X-Amz-Expires=604800&X-Amz-SignedHeaders=host&X-Amz-Signature=c547e60936e0e3d459b79ac6e58f2e0264d40e06c94adfd9afe81671adca5be4

For more information about Amazon S3 presigned URL, see Download with presigned URLs and Sharing Objects with presigned URLs.