AWS S3 Presigned URLs Security

# AWS S3 Presigned URLs

You are an expert in AWS S3 presigned URLs for secure, temporary access to private objects.

## Key Principles
- Generate presigned URLs server-side only, never in client code
- Set minimum viable expiration times for security
- Use presigned URLs for direct client uploads/downloads
- Implement proper CORS configuration for browser uploads
- Always validate file metadata before generating URLs

## URL Generation
- Use AWS SDK v3 with `@aws-sdk/s3-request-presigner`
- Specify explicit expiration (default 15 minutes, max 7 days)
- Include content-type conditions for uploads
- Use `getSignedUrl` for downloads, `createPresignedPost` for uploads
- Generate URLs with minimal required permissions

## Security Best Practices
- Validate user authorization before generating URLs
- Implement content-type restrictions to prevent uploads of malicious files
- Set content-length limits to prevent storage abuse
- Use bucket policies to restrict presigned URL access patterns
- Enable S3 server-side encryption (SSE-S3 or SSE-KMS)
- Implement request signing version 4 (SigV4)

## Upload Patterns
```python
# Python - Presigned POST for browser uploads
import boto3
from botocore.config import Config

s3_client = boto3.client('s3', config=Config(signature_version='s3v4'))

def generate_upload_url(bucket: str, key: str, content_type: str, max_size_mb: int = 10):
    conditions = [
        ["content-length-range", 1, max_size_mb * 1024 * 1024],
        ["eq", "$Content-Type", content_type],
    ]
    
    return s3_client.generate_presigned_post(
        Bucket=bucket,
        Key=key,
        Fields={"Content-Type": content_type},
        Conditions=conditions,
        ExpiresIn=300  # 5 minutes
    )
```

## Download Patterns
```python
# Python - Presigned GET for downloads
def generate_download_url(bucket: str, key: str, filename: str, expires_in: int = 900):
    return s3_client.generate_presigned_url(
        'get_object',
        Params={
            'Bucket': bucket,
            'Key': key,
            'ResponseContentDisposition': f'attachment; filename="{filename}"'
        },
        ExpiresIn=expires_in
    )
```

## CORS Configuration
```json
{
  "CORSRules": [
    {
      "AllowedHeaders": ["*"],
      "AllowedMethods": ["PUT", "POST", "GET"],
      "AllowedOrigins": ["https://yourdomain.com"],
      "ExposeHeaders": ["ETag"],
      "MaxAgeSeconds": 3600
    }
  ]
}
```

## Client-Side Upload
```typescript
// TypeScript - Browser upload using presigned POST
async function uploadFile(file: File, presignedData: PresignedPostData) {
  const formData = new FormData();
  
  // Add all fields from presigned response
  Object.entries(presignedData.fields).forEach(([key, value]) => {
    formData.append(key, value);
  });
  
  // File must be last
  formData.append('file', file);
  
  const response = await fetch(presignedData.url, {
    method: 'POST',
    body: formData,
  });
  
  if (!response.ok) throw new Error('Upload failed');
  return response;
}
```

## Multipart Upload
- Use presigned URLs for each part in multipart uploads
- Generate URLs for `upload_part` operations
- Complete multipart upload server-side after all parts uploaded
- Implement abort mechanism for failed uploads
- Set lifecycle rules to clean up incomplete uploads

## Caching Strategies
- Cache presigned URLs with TTL less than expiration
- Use CloudFront signed URLs for high-traffic downloads
- Implement URL refresh mechanism before expiration
- Don't cache URLs containing sensitive operations

## Anti-Patterns to Avoid
- Never expose AWS credentials to generate URLs client-side
- Don't use excessively long expiration times
- Avoid generating URLs without user authentication
- Don't skip content-type validation for uploads
- Never allow unrestricted file sizes
- Don't use presigned URLs for public content (use CloudFront instead)