AWS presigned URLs grant time-limited access, not a compliance seal

The workload

A product that lets a customer upload or download a file without exposing the whole storage bucket publicly needs a way to grant access to a single object for a limited time. AWS's documentation on presigned URLs for Amazon S3 describes the standard mechanism most managed object-storage integrations use: a URL generated from real AWS credentials that carries permission to perform one action — a GET, PUT or HEAD — on one object, for a limited time, without the requester needing any AWS account. Building this in is application code that calls an SDK's presign function before serving a link; it is not a purchased feature.

What the documents show

AWS's documentation states, verified, that 'anyone with valid security credentials can create a presigned URL,' but its capabilities are limited to whatever permissions the credential-holder has, and that in effect 'presigned URLs are bearer tokens that grant access to those who possess them' — possession of the link, not identity, is what the receiving server checks. On expiration, the documentation states, verified, that a Console-generated URL can expire between 1 minute and 12 hours, while a CLI- or SDK-generated one can expire up to 7 days out, and that a URL always expires early if its underlying credential is revoked first, regardless of the time originally specified. A companion page on sharing objects with presigned URLs confirms the 7-day CLI ceiling directly in a worked example, verified, specifying an expires-in value of 604800 seconds.

The operating cost

A presigned URL costs nothing beyond the AWS request and storage charges already billed for the object, documented separately on AWS's pricing pages. The operational cost is risk management: because a leaked presigned URL is usable by whoever holds it until it expires, AWS recommends restricting capabilities further with bucket-policy conditions, such as a maximum signature age, additional configuration work rather than a fee.

The stop condition

AWS's documentation states the ceilings, not a required window. This is an editorial stop condition: a presigned URL's lifetime should match the shortest span the use case needs — minutes for a browser download, not the 7-day default maximum — and any use of presigned URLs toward a compliance obligation should stop at the mechanism and start with a separate check of what that obligation requires, since neither AWS page makes a compliance claim of its own.

• What expiration time does the application actually set, versus the maximum AWS allows?
• Would a leaked presigned URL, used by someone other than the intended recipient before it expires, cause a problem this design has not accounted for?
• Is a presigned URL being used to meet a specific regulatory requirement, and has that requirement's actual text been checked separately?

The mechanism AWS documents is narrow and specific: a time-boxed, single-action bearer credential built from a real AWS identity's permissions. It is a useful default for object access. It is not, on its own terms, a certification of anything.