How to Generate a Presigned S3 URL via AWS CLI

Question

Is there a way to create presigned URL for objects in S3 bucket using AWS CLI?

I know that could be done using SDK, but is it possible with CLI?

I found this on one of the AWS docs, but can't complete the command:

s3cmd signurl s3://BUCKET/OBJECT <expiry_epoch|+expiry_offset>

Any help?

helloV · Accepted Answer · 2017-08-24T19:19:51.687

81

Did you try aws s3 presign?

Generate a pre-signed URL for an Amazon S3 object. This allows anyone who receives the pre-signed URL to retrieve the S3 object with an HTTP GET request. For sigv4 requests the region needs to be configured explicitly.

This will generate a URL that will expire in 3600 seconds (default)

aws s3 presign s3://mybucket/myobject

This will generate a URL that will expire in 300 seconds

aws s3 presign s3://mybucket/myobject  --expires-in 300

Output

https://mybucket.s3.amazonaws.com/myobject?AWSAccessKeyId=AKIAJXXXXXXXXXXXXXXX&Expires=1503602631&Signature=ibOGfAovnhIF13DALdAgsdtg2s%3D

edited Aug 24 '17 at 19:19

answered Aug 24 '17 at 19:16

helloV

50,176
7
137
145

I am trying this for the first time. I don't know how do we create signed urls for S3 objects using AWS CLI. – Shabbir Bata Aug 24 '17 at 19:17
1

Thank you for the answer. Will check. So the maximum time one can have is 7 days? – Shabbir Bata Aug 24 '17 at 19:26
So then can you give access to upload to a specific folder with this? – red888 Jan 21 '18 at 15:56
10

This doesn't seem to work for PUT or POST but maybe I'm doing something wrong. Docs only suggest GET, but maybe there is another way to accomplish this with the CLI. – aglassman Apr 05 '18 at 20:46
This needs more attention on teh interwebs Thanks @helloV. Wish I'd have seen it earlier. – Josiah Nov 05 '18 at 22:24

score 6 · Answer 2 · edited Oct 11 '18 at 02:51

6

Wildcards are now supported.

E.g. aws s3 presign s3://mybucket/*

edited Oct 11 '18 at 02:51

Stephen Rauch

47,830
31
106
135

answered Oct 11 '18 at 02:34

Gerald B

69
1
1

AFAICT, it will make the presign link, but it's invalid. – belial Apr 16 '20 at 06:33

score 2 · Answer 3 · edited Apr 07 '21 at 20:46

@Michael and @Shabbir,

Yes, aws s3 presign does not accept globbing/wildcards/, --include, --exclude, or --recursive. aws ls does not accept -1; it behaves as ls -lp or ls -lph.

a loop works:

for file in $(aws s3 ls s3://mybucket --profile myprofile \
--endpoint-url <my-endpoint> | awk '{print $NF}'); do
    aws s3 presign --expires-in 300 "s3://mybucket/$file" |
    --profile my-profile --endpoint-url <my-endpoint>
done

score 2 · Answer 4 · answered Apr 17 '19 at 07:27

2

if you do aws s3 presign s3://bucket-address/my-file.csv

you get back url. Then when you pass it to wget make sure you wrap it with apostrophes

wget 'https://bucket-address.s3.aws.com/xbxxxxxxxxxxxxxxx'

if you just do without apostrophes you will get 403 wget https://bucket-address.s3.aws.com/xbxxxxxxxxxxxxxxx

I'm describing more in https://blog.eq8.eu/til/transfer-file-to-server.html

answered Apr 17 '19 at 07:27

equivalent8

13,754
8
81
109

3

Thanks for the heads up, but that is nothing new there in the context of this question. The issue with quotes in merely an issue in relation to the `&` and how that in interpreted by the shell. It might not be an issue in another shell, way windows command line. – ϹοδεMεδιϲ Sep 13 '20 at 09:39

score 1 · Answer 5 · answered Aug 24 '17 at 20:00

1

So the command for pre-signed URL is:

aws s3 presign s3://bucket-address/  --expires-in 300

But the caveat is; we can have pre-signed URL's that works for individual file/object level and not on directory level.

Happy to be corrected if wrong.

answered Aug 24 '17 at 20:00

Shabbir Bata

861
2
11
23

It sort of appears that you can't generate a pre-signed url for a bucket. – Michael Ababio Feb 20 '18 at 15:51
Yes, `aws s3 presign` does not accept globbing/wildcards/, `--include`, `--exclude`, or `--recursive'. aws `ls` does not accept `-1`; it behaves as `ls -lp` or `ls -lph`. a loop works: ``` for file in $(aws s3 ls s3://mybucket --profile myprofile --endpoint-url | awk '{print $NF}'); do aws s3 presign --expires-in 300 "s3://mybucket/$file" --profile my-profile --endpoint-url done ``` – Monte Hayward Jul 19 '18 at 20:47

How to Generate a Presigned S3 URL via AWS CLI

5 Answers5

Linked