{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/bound-presigned-s3-access-by-both-url-and-credential-lifetimes/", "item": { "id": "https://update.dsesecurity.com/updates/bound-presigned-s3-access-by-both-url-and-credential-lifetimes/", "slug": "bound-presigned-s3-access-by-both-url-and-credential-lifetimes", "url": "https://update.dsesecurity.com/updates/bound-presigned-s3-access-by-both-url-and-credential-lifetimes/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/bound-presigned-s3-access-by-both-url-and-credential-lifetimes.md", "json": "https://update.dsesecurity.com/api/v1/posts/bound-presigned-s3-access-by-both-url-and-credential-lifetimes/" }, "title": "Bound presigned S3 access by both URL and credential lifetimes", "summary": "Avoid promising a download window longer than the signing credentials can support.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "physical-security", "label": "Physical security", "alt": "Integrated video surveillance and controlled entry at a modern commercial facility.", "card_url": "https://update.dsesecurity.com/assets/editorial/physical-security-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/physical-security-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/physical-security-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:13:26+00:00", "modified_at": "2026-10-20T18:34:28+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 247, "potentially_affected": "This applies to S3 presigned object requests; it does not make the recipient an IAM user.", "dse_recommendation": "DSE recommends choosing the smallest practical sharing window and recording the credential type used by the signing service.", "primary_source": { "name": "AWS Documentation", "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-presigned-url.html", "published_on": null, "authority": "docs.aws.amazon.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Avoid promising a download window longer than the signing credentials can support.

\n

Source facts

\n

An S3 presigned URL uses its creator’s permissions and can be reused before expiry. A URL signed with temporary credentials expires when those credentials expire, even when its requested URL lifetime is longer. AWS also documents signature-age policy conditions and describes these URLs as bearer tokens.

\n

Source: AWS Documentation.

\n

Applicability

\n

This applies to S3 presigned object requests; it does not make the recipient an IAM user.

\n

DSE recommendation

\n

DSE recommends choosing the smallest practical sharing window and recording the credential type used by the signing service. Explain expiry to the recipient without exposing the URL in public tickets or analytics. Keep generated links out of routine logs and use a fresh link when support needs a retry after expiry. Review upload object keys as carefully as download permissions. Agree who can revoke the underlying access and how the team will respond if a link is disclosed. Include expiry wording in the sharing interface and support template so users know when to request a replacement. Document the intended recipient, object purpose and revocation contact without retaining the usable link itself in an unrestricted operational record.

\n

Verification

\n

Proposed verification: create a link for disposable data with a short-lived role session, compare behavior before and after credential expiry, and test any signature-age restriction separately. Confirm support instructions describe the observed limit and do not claim that a URL is single-use.

\n

Official reference

\n

AWS Documentation. Reviewed October 20, 2026.

", "content_text": "Avoid promising a download window longer than the signing credentials can support.\nSource facts\nAn S3 presigned URL uses its creator’s permissions and can be reused before expiry. A URL signed with temporary credentials expires when those credentials expire, even when its requested URL lifetime is longer. AWS also documents signature-age policy conditions and describes these URLs as bearer tokens.\nSource: AWS Documentation.\nApplicability\nThis applies to S3 presigned object requests; it does not make the recipient an IAM user.\nDSE recommendation\nDSE recommends choosing the smallest practical sharing window and recording the credential type used by the signing service. Explain expiry to the recipient without exposing the URL in public tickets or analytics. Keep generated links out of routine logs and use a fresh link when support needs a retry after expiry. Review upload object keys as carefully as download permissions. Agree who can revoke the underlying access and how the team will respond if a link is disclosed. Include expiry wording in the sharing interface and support template so users know when to request a replacement. Document the intended recipient, object purpose and revocation contact without retaining the usable link itself in an unrestricted operational record.\nVerification\nProposed verification: create a link for disposable data with a short-lived role session, compare behavior before and after credential expiry, and test any signature-age restriction separately. Confirm support instructions describe the observed limit and do not claim that a URL is single-use.\nOfficial reference\nAWS Documentation. Reviewed October 20, 2026.", "content_markdown": "Avoid promising a download window longer than the signing credentials can support.\n\n## Source facts\n\nAn S3 presigned URL uses its creator’s permissions and can be reused before expiry. A URL signed with temporary credentials expires when those credentials expire, even when its requested URL lifetime is longer. AWS also documents signature-age policy conditions and describes these URLs as bearer tokens.\n\nSource: [AWS Documentation](https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-presigned-url.html).\n\n## Applicability\n\nThis applies to S3 presigned object requests; it does not make the recipient an IAM user.\n\n## DSE recommendation\n\nDSE recommends choosing the smallest practical sharing window and recording the credential type used by the signing service. Explain expiry to the recipient without exposing the URL in public tickets or analytics. Keep generated links out of routine logs and use a fresh link when support needs a retry after expiry. Review upload object keys as carefully as download permissions. Agree who can revoke the underlying access and how the team will respond if a link is disclosed. Include expiry wording in the sharing interface and support template so users know when to request a replacement. Document the intended recipient, object purpose and revocation contact without retaining the usable link itself in an unrestricted operational record.\n\n## Verification\n\nProposed verification: create a link for disposable data with a short-lived role session, compare behavior before and after credential expiry, and test any signature-age restriction separately. Confirm support instructions describe the observed limit and do not claim that a URL is single-use.\n\n## Official reference\n\n[AWS Documentation](https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-presigned-url.html). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/bound-presigned-s3-access-by-both-url-and-credential-lifetimes/", "url": "https://update.dsesecurity.com/updates/bound-presigned-s3-access-by-both-url-and-credential-lifetimes/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/bound-presigned-s3-access-by-both-url-and-credential-lifetimes/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Bound presigned S3 access by both URL and credential lifetimes", "item": "https://update.dsesecurity.com/updates/bound-presigned-s3-access-by-both-url-and-credential-lifetimes/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/bound-presigned-s3-access-by-both-url-and-credential-lifetimes/#article", "identifier": "https://update.dsesecurity.com/updates/bound-presigned-s3-access-by-both-url-and-credential-lifetimes/", "url": "https://update.dsesecurity.com/updates/bound-presigned-s3-access-by-both-url-and-credential-lifetimes/", "headline": "Bound presigned S3 access by both URL and credential lifetimes", "description": "Avoid promising a download window longer than the signing credentials can support.", "abstract": "Avoid promising a download window longer than the signing credentials can support.", "articleBody": "Avoid promising a download window longer than the signing credentials can support.\nSource facts\nAn S3 presigned URL uses its creator’s permissions and can be reused before expiry. A URL signed with temporary credentials expires when those credentials expire, even when its requested URL lifetime is longer. AWS also documents signature-age policy conditions and describes these URLs as bearer tokens.\nSource: AWS Documentation.\nApplicability\nThis applies to S3 presigned object requests; it does not make the recipient an IAM user.\nDSE recommendation\nDSE recommends choosing the smallest practical sharing window and recording the credential type used by the signing service. Explain expiry to the recipient without exposing the URL in public tickets or analytics. Keep generated links out of routine logs and use a fresh link when support needs a retry after expiry. Review upload object keys as carefully as download permissions. Agree who can revoke the underlying access and how the team will respond if a link is disclosed. Include expiry wording in the sharing interface and support template so users know when to request a replacement. Document the intended recipient, object purpose and revocation contact without retaining the usable link itself in an unrestricted operational record.\nVerification\nProposed verification: create a link for disposable data with a short-lived role session, compare behavior before and after credential expiry, and test any signature-age restriction separately. Confirm support instructions describe the observed limit and do not claim that a URL is single-use.\nOfficial reference\nAWS Documentation. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:13:26+00:00", "dateModified": "2026-10-20T18:34:28+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/bound-presigned-s3-access-by-both-url-and-credential-lifetimes/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/bound-presigned-s3-access-by-both-url-and-credential-lifetimes/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/physical-security-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/physical-security-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Bound presigned S3 access by both URL and credential lifetimes" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 247, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "AWS Documentation", "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-presigned-url.html" } } ] } }