What is difference between Pre-Signed Url and Signed Url?

Question

I intend to private object in public bucket, thus restricting access to object, not other objects in bucket. And I want to setup CloudFront to serve content with Signed URLs. Now in AWS S3 documentation, I see two different terms, one is Pre-signed URL to access private object, and other is Signed URL which requires downloading private key etc and do something more.

What is difference between Pre-Signed URL and Signed URLs? Can I use PreSigned URL's with CloudFront?

C# Library has method GetPreSignedURL, does it automatically download private keys etc and does signing or this GetPreSignedURL method is different then S3 URL Signing that requires setting up private keys and then signing URL?

It may helps you http://stackoverflow.com/questions/9098474/getting-a-pre-authenticated-url-to-an-s3-bucket — Ramesh Rajendran, Dec 31 '13 at 19:17
@RameshRajendran, I know how to generate one, but I want to know if I can use it with CloudFront without lots of configuration steps. — Akash Kava, Dec 31 '13 at 20:57

score 18 · Answer 1 · edited Jul 14 '21 at 08:10

First we gotta distinguish the services we are talking about and referring to here. Both S3 and CloudFront have URL signing features that work differently.

However, only S3 refers to them as Pre-signed URLs; CloudFront refers to them as Signed URLs and Signed Cookies.

Note the service names in the URLs, in the documentation below.

https://docs.aws.amazon.com/AmazonS3/latest/dev/PresignedUrlUploadObject.html

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-signed-urls.html#private-content-how-signed-urls-work

For a more in depth comparison of the different services check out the link below. If I had to guess, I would guess that AWS chose to name their signing services differently to avoid confusion.

https://tutorialsdojo.com/s3-pre-signed-urls-vs-cloudfront-signed-urls-vs-origin-access-identity-oai/

I think the dojo tutorials link has been changed. Looks to me like the new link is at: https://tutorialsdojo.com/s3-pre-signed-urls-vs-cloudfront-signed-urls-vs-origin-access-identity-oai/ — Jack, Jun 09 '21 at 07:29

score 6 · Accepted Answer · edited Mar 11 '16 at 19:34

6

From AWS docs

A pre-signed URL gives you access to the object identified in the URL, provided that the creator of the pre-signed URL has permissions to access that object. That is, if you receive a pre-signed URL to upload an object, you can upload the object only if the creator of the pre-signed URL has the necessary permissions to upload that object.

Again, from AWS docs

A signed URL includes additional information, for example, an expiration date and time, that gives you more control over access to your content. This additional information appears in a policy statement, which is based on either a canned policy or a custom policy. The differences between canned and custom policies are explained in the next two sections.

edited Mar 11 '16 at 19:34

kmonsoor

7,600
7
41
55

answered Dec 31 '13 at 19:15

Amit Bisht

4,870
14
54
83

1

Where you copy past from? can you share your URL for more details? – Ramesh Rajendran Dec 31 '13 at 19:16
9

Pre-Signed Url also has expiry date & time. – Akash Kava Jan 01 '14 at 03:42
1

@AkashKava Is it possible to have a url without a expiration date or time? – Ted Taylor of Life Dec 28 '16 at 13:28
1

@TedTaylorofLife no, the max. is 7 days – NineCattoRules Apr 28 '17 at 15:23
3

Actually, they are the same. S3 has pre-signed URL. There is a notion of “URL signing”, which is a process of creating pre-signed URL’s for S3 objects. However, when someone says “signed URL”, it’s just short hand for “pre-signed URL”. Also your second link doesn't says anything about Signed URL – Harry Aug 09 '18 at 11:34

score 4 · Answer 3 · answered Sep 19 '19 at 04:51

So far for my research:

A pre-signed URL(AWS doc): gives you access to the object identified in the URL, provided that the creator of the pre-signed URL has permissions to access that object. That is, if you receive a pre-signed URL to upload an object, you can upload the object only if the creator of the pre-signed URL has the necessary permissions to upload that object.

All objects and buckets by default are private. The pre-signed URLs are useful if you want your user/customer to be able to upload a specific object to your bucket, but you don't require them to have AWS security credentials or permissions. When you create a pre-signed URL, you must provide your security credentials and then specify a bucket name, an object key, an HTTP method (PUT for uploading objects), and an expiration date and time. The pre-signed URLs are valid only for the specified duration.

Signed Url (AWS doc): A signed URL includes additional information, for example, an expiration date and time, that gives you more control over access to your content. This additional information appears in a policy statement, which is based on either a canned policy or a custom policy. The differences between canned and custom policies are explained in the next two sections.

Conclusion based on my understanding:

Pre-signed Url used for creator, mean to upload new objects.

Signed Url all about accessing existing objects.

The presigned url (as per S3 behaviour) can also expire – Raul Lapeira Herrero Mar 06 '23 at 21:29 — Raul Lapeira Herrero, Mar 06 '23 at 21:29

score 0 · Answer 4 · answered Oct 06 '20 at 17:43

CloudFront Signed URL

• Allow access to a path, no matter the origin

• Account wide key-pair, only the root can manage it

• When creating signed URLs, we can specify the following restrictions: 1) Set expiration date and time 2) Range of IP addresses for which the URL will be valid

• Can leverage caching features

S3 Pre-Signed URL

• Issue a request as the person who pre-signed the URL

• Uses the IAM key of the signing IAM principal(user/account)

• Limited lifetime

What is difference between Pre-Signed Url and Signed Url?

4 Answers4