Skip to content
CloudAdhar — Building cloud futuresCloudAdharBUILDING CLOUD FUTURESAWS Console
← All labs
Storage / Hands-on lab

Share a private file for five minutes

Create a time-limited S3 download, compare signed and unsigned access, and verify expiry.

Beginner25 minutesUpdated 2026-09-23Use your own AWS learning account

Overview

A college club needs to share a synthetic event brief with a reviewer without making its storage bucket public. Create a temporary download and prove both successful access and expiry.

Architecture

The object stays in a private S3 bucket. An authorized IAM session signs a request; a recipient presents that signed URL to S3. Anyone with the URL can use it until it expires or its underlying credentials stop being valid. It is not a one-time link.

Amazon S3 service icon

Choose this pattern for temporary access to a specific object. Use an authenticated application when you need user-by-user access decisions or a download audit tied to application identities.

Prerequisites

  • A learning account with permission to create a bucket, upload and read an object, and delete the lab resources.
  • A small local file called event-brief.txt containing only sample event information.
  • A private browser window for testing unsigned access. Do not share or publish your signed URL.

Steps

1. Store the document privately

Create a uniquely named general-purpose S3 bucket in one region. Keep Block Public Access enabled, ACLs disabled, and default encryption. Upload event-brief.txt. Record the bucket region and object key.

2. Test ordinary access

Open the object details and copy its ordinary Object URL. Try it in a private browser window with no AWS login. An AccessDenied response is expected. Do not fix this by changing bucket permissions.

3. Create temporary access

Select the object and choose the action to share with a presigned URL. Choose a five-minute expiry using the console's available duration controls. Generate the URL and open it in the same private window. Confirm that the downloaded text matches your sample file.

4. Check expiry

After the five-minute window, request the URL again. Use the browser network tools with cache disabled, or a fresh private session, so a cached download does not masquerade as a successful new S3 request. The request should fail after expiry. A previously downloaded copy remains readable; expiry does not erase it.

5. Explain a failure

If the signed request fails immediately, check the exact object key, the signer's GetObject permission, session expiry, and bucket policy. Do not paste the signature into a public issue or chat.

Verification

  • Ordinary anonymous URL is denied.
  • Signed URL retrieves the exact sample contents before expiry.
  • A fresh request fails after expiry.
  • Bucket remains private throughout.

Save a redacted result table, not the working URL.

Cost and cleanup

Storage, download requests, and transfer may incur charges depending on your account and region. Delete the sample object and bucket. If you enabled versioning, remove all versions and delete markers before deleting the bucket. Confirm that the dedicated bucket is gone.

References