Lend a file, not the whole bucket — S3 and Presigned URLs

Your goal

Upload a private practice file and download it through a temporary signed request.

Why this matters

Someone may need one private file without access to the whole bucket. A signed request grants temporary access to that object. You will upload your text and check a real signed download.

Words you will use

A presigned URL is a link with a signature that grants a specific request. The signer supplies the permission. Expiration is when the link stops being valid.

How to proceed

Start a fresh emulator, read each numbered step, and enter the practice settings shown. Run the action, inspect its API receipt, then continue. Finish lab checks the emulator state again before saving your progress.

1. Create a private file

Create a bucket and save the message below as lesson.txt. Keep the bucket private. The message gives you something recognizable to check after the signed download.

Practice message: Type a short message that you can recognize in the API result. Suggested practice value: Hello from my lab.

2. Make a short-lived download link

Generate a signed GET request for this one object. The server keeps the URL private and uses the emulator’s own credentials. Choose a short lifetime for this practice request.

Link lifetime in seconds: Use 30–300 seconds. The link is for this one object. Suggested practice value: 60.

3. Download and compare the contents

Use the signed request against the local emulator. The lab compares the returned text with your upload. The signed URL itself is kept on the server because anyone holding it could use it while valid.

Practice, then check your understanding

Perform the actions yourself and inspect the returned state. Errors keep your settings so you can retry. Starting another lab clears the previous live environment. Earned XP is kept, and signed-in achievements sync to your account. Replay does not award duplicate XP.

Read the official AWS documentation for service behavior and production details.