Pre‐Signed URLs

Intent: Delegate temporary, narrow authority to access a specific resource via a signed URL.

Context:
A service needs to let an untrusted client read or upload an object (e.g. a file) without sharing full credentials or maintaining a session.

Solution:
Issue a URL containing the object’s identity, an expiry time, and a cryptographic signature.
Possession of the URL grants exactly the authorized operation (GET, PUT, etc.) until it expires.
The URL is the capability.

Consequences:
✔️ Least authority by construction
✔️ Stateless and scalable
⚠️ Bearer semantics — must protect against link leakage

Related patterns: Bearer Token, Magic Link, CareTaker

Citations:

• Download and upload objects with presigned URLs — AWS S3 User Guide (original concept, 2013; updated 2024).
• Securing Amazon S3 presigned URLs for serverless applications — AWS Compute Blog (2025-05).
• Create and Use SAS Tokens — Microsoft Azure Docs (2016).
• Signed URLs — Google Cloud Storage Docs (2017).