-1

I know that we can generate a download key for an object with a specific time to expire. But how can I invalidate an already generated key manually?

Imagine I get an acknowledge from a client that successfully downloaded the file, so I want to invalidate the generated key.

John Rotenstein
  • 241,921
  • 22
  • 380
  • 470
meshkati
  • 1,720
  • 2
  • 16
  • 29

1 Answers1

3

It appears that you are referring to a Pre-Signed URL, which grants time-limited access to a private object in Amazon S3.

The pre-signed URL uses credentials from an Access Key that does have permission to access the object. The URL is then signed with a hashed version of the Secret Key to validate the request. It is effectively saying "I approve this request until this timestamp."

There is no way to invalidate a pre-signed URL. However, since the approval is linked to an identity, you can invalidate that identity's permissions to access the object and this will invalidate the pre-signed URL. It's effectively saying "That's great that you authorize the request, but you are no longer authorized to access it yourself, so you can't authorize anybody else, either!"

Example:

  • IAM User User-A has permission to access a private object
  • User-A generates a pre-signed URL for the object
  • The pre-signed URL works
  • Permission is revoked from User-A so that they no longer have permission to access the object
  • The pre-signed URL no longer works

This doesn't necessarily work well for your "download only once" use-case. To do that, you will really need to send requests and downloads via an application rather than relying on Amazon S3 to enforce the "once-only" rule.

John Rotenstein
  • 241,921
  • 22
  • 380
  • 470
  • Any ideas on how one would generate such an arrangement using AWS pieces? My thought pattern is an EC2 running some custom python that will relay the file out of S3 with "complete" flagging in a database to guard against the next attempt. I think that the 15 minute cap on lambda would exclude this working with slow download speeds and large files. – Patrick Scott Best Apr 23 '22 at 23:56