S3 Pre-signed URLs vs CloudFront Signed URLs vs Origin

Access Identity (OAI)

April 28,
2019

S3 Pre-signed URLs CloudFront Signed URLs Origin Access Identity

All S3 buckets and You can control user access to You can configure
objects by default your private content in two an S3 bucket as the
are private. Only the ways origin of a
object owner has Restrict access to files in CloudFront
permission to access CloudFront edge caches distribution. OAI
these objects. Pre- Restrict access to files in prevents users from
signed URLs use the your Amazon S3 bucket viewing your S3 files
owner’s security (unless you’ve by simply using the
credentials to grant configured it as a direct URL for the
others time-limited website endpoint) file. Instead, they
permission to You can configure CloudFront would need to
download or upload to require that users access access it through a
objects. your files using either signed CloudFront URL.
When creating a pre- URLs or signed cookies. You To require that
signed URL, you (as then develop your application users access your
the owner) need to either to create and distribute content through
provide the signed URLs to authenticated CloudFront URLs,
following: users or to send Set-Cookie you perform the
Your security headers that set signed following tasks:
credentials cookies on the viewers for Create a
An S3 bucket authenticated users. special
name When you create signed URLs CloudFront
An object key or signed cookies to control user called an

1/3
 Specify the access to your files, you can origin access
HTTP method specify the following identity.
(GET to restrictions: Give the
download the An expiration date and origin access
object or PUT time for the URL identity
to upload an (Optional) The date and permission to
object) time the URL becomes read the files
Expiration date valid in your
and time of the (Optional) The IP bucket.
URL. address or range of Remove
addresses of the permission
computers that can be for anyone
used to access your else to use
content Amazon S3
You can use signed URLs or URLs to read
signed cookies for any the files
CloudFront distribution, (through
regardless of whether the bucket
origin is an Amazon S3 bucket policies or
or an HTTP server. ACLs).
You cannot set OAI
if your S3 bucket is
configured as a
website endpoint.

References:

https://docs.aws.amazon.com/AmazonS3/latest/dev/PresignedUrlUploadObject.html
https://docs.aws.amazon.com/AmazonS3/latest/dev/ShareObjectPreSignedURL.html
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.ht
ml
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-
restricting-access-to-s3.html

***

AWS Certified Solutions Architect is consistently among the top paying IT certifications in the
world, considering that Amazon Web Services is the leading cloud services platform with almost
50% market share! Earn over $150,000 per year with an AWS certification!

Subscribe to our newsletter for more helpful AWS training notes and blogs like this and answer as
many AWS practice exams as you can.

Subscribe to our Newsletter

Sign up now and have the latest tech tutorials delivered straight to your mailbox.
2/3
PLUS: Upgrade your career by getting exclusive access to recent AWS exam passers' tips,
freebies, promotions and lots more!
I agree to have my personal information transfered to AWeber ( more information )

3/3