The market emails each customer an invoice link. The invoices must not be public, and the customer has no AWS account. A presigned URL solves both: a link to one object, signed with your credentials, that works for a limited time.
https://market-docs….s3…/invoice.pdfthe object?X-Amz-Credential=AKIA…who signed it&X-Amz-Expires=300for how long&X-Amz-Signature=…the proof
Making one
sh
aws s3 presign s3://market-docs-1k6mln0/invoice.pdf --expires-in 300--expires-in is in seconds; the default is an hour. The CLI computes the signature on your machine: nothing changes in the bucket, which stays private.
Using one
sh
URL=$(aws s3 presign s3://market-docs-1k6mln0/invoice.pdf --expires-in 300)sh
curl -s "$URL"Anyone with the link, in a browser or with curl, gets the object. Keep it in double quotes: the URL is full of & characters the shell would otherwise act on.
When the time is up, the same request gets an error instead:
text
<Error><Code>AccessDenied</Code><Message>Request has expired</Message></Error>The URL acts with the permissions of whoever signed it, for one object and one action. If the signer cannot read the object, neither can the link.