Bound presigned S3 access by both URL and credential lifetimes

Avoid promising a download window longer than the signing credentials can support.

Source facts

An S3 presigned URL uses its creator’s permissions and can be reused before expiry. A URL signed with temporary credentials expires when those credentials expire, even when its requested URL lifetime is longer. AWS also documents signature-age policy conditions and describes these URLs as bearer tokens.

Source: AWS Documentation.

Applicability

This applies to S3 presigned object requests; it does not make the recipient an IAM user.

DSE recommendation

DSE recommends choosing the smallest practical sharing window and recording the credential type used by the signing service. Explain expiry to the recipient without exposing the URL in public tickets or analytics. Keep generated links out of routine logs and use a fresh link when support needs a retry after expiry. Review upload object keys as carefully as download permissions. Agree who can revoke the underlying access and how the team will respond if a link is disclosed. Include expiry wording in the sharing interface and support template so users know when to request a replacement. Document the intended recipient, object purpose and revocation contact without retaining the usable link itself in an unrestricted operational record.

Verification

Proposed verification: create a link for disposable data with a short-lived role session, compare behavior before and after credential expiry, and test any signature-age restriction separately. Confirm support instructions describe the observed limit and do not claim that a URL is single-use.

Official reference

AWS Documentation. Reviewed October 20, 2026.