As a service provider, I allow logged in users to upload documents to a web server, and upload it to S3. The logged in user should subsequently be able to view his own documents, and I want to serve it directly from S3, with some token-based authentication per request.

I thought that this was a pretty simple and standard use case for S3, but I am unable to find a standard way to this.

Does S3 effectively support per request authentication at object level, and what is the "correct" or "standard" way to do this.

I have read some documentation for STS, but am not able to find a clear way to solve this.

Pre signed urls almost works; the only difficulty is that that it seems to only work with a pre-set expiration time, and "logout" is not supported.


Would it be possible to grant the user an IAM role? If so, you can scope the roles so that each user can only see objects that begin with their prefix, e.g. username/*.

Each user's IAM role will grant them only access to objects whose keys begin with the specified prefix.

The other option would be to use lambda functions to generate pre-signed urls for the user on a per request basis (with very short lived time), hence removing the need for logout, (i.e user request a file, and gets redirected by lambda to the pre-signed url per request).

To the point though, there isn't a 'right' way of doing this as far as I know, and there might be many other options I'm not aware of either.

  • IAM roles are normally limited to 1000, right? The number of user accounts could be arbitrary. After reading whatever is available, it seems to me that S3 just does not support authentication at object level for logged in users in a scalable manner.
    – ranban282
    Sep 11 '20 at 4:59
  • They do. It's called shared signature, where your web app would sign a URL that would be valid for some given time. The web app hands this URL to the client.
    – vidarlo
    Oct 5 '21 at 16:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.