Can you revoke an S3 presigned URL? (and when it really expires)
You shared a presigned link to a private file and now you want it dead before it expires. There is no list of issued links to delete, but there are four real levers.
What is inside a presigned URL
Split one at the ? and URL-decode it (the URL encoder/decoder does this in your browser). The parts that matter:
| Parameter | Meaning |
|---|---|
X-Amz-Credential | Which access key signed it, plus the date and region |
X-Amz-Date | When it was signed (UTC, 20261108T161500Z style) |
X-Amz-Expires | Seconds it stays valid after X-Amz-Date; the SigV4 maximum is 604800 (7 days) |
X-Amz-Security-Token | Present when temporary credentials signed it (a role, SSO session or instance profile) |
X-Amz-Signature | The signature S3 recomputes and compares on every request |
Expiry time = X-Amz-Date + X-Amz-Expires seconds. The Unix time converter helps if you want it in your own time zone.
Four ways to cut a link off early
| Lever | Kills | Side effects |
|---|---|---|
| Remove the signer's permission on that object or prefix (IAM or bucket policy deny) | Every URL signed by that identity for those objects | The app loses that access too, unless it signs with a separate identity |
| Deactivate or delete the access key (IAM user) or revoke the role's active sessions | Every URL signed with those credentials | Anything else using those credentials breaks; rotate first |
Bucket policy deny on s3:signatureAge | Every signature older than a limit you choose | Applies to all signed requests that match the policy |
| Delete, move or rename the object | Every URL to that key | Other users of the object lose it; overwriting instead serves the new content to the old link |
The IAM console's “Revoke active sessions” on a role adds a deny for sessions issued before now (an aws:TokenIssueTime condition), which also stops URLs signed with those sessions.
Why some links die sooner than you set
A presigned URL can never outlive the credentials that signed it. Sign with a Lambda role, an EC2 instance profile or an SSO session and the link stops working when that session expires, often within an hour or a few hours, even if X-Amz-Expires says 7 days. If you need longer links, sign with credentials that last at least that long; if you want links that are easy to kill, that same fact works in your favour.
Clock skew matters too: if the signing machine's clock is ahead, S3 can reject a fresh link as not yet valid or already expired.
Revoking does not recall copies
Once someone has downloaded the file, nothing on S3 can take it back. Revoking only stops future requests. If the file held secrets (keys, passwords, personal data), rotate or change those as well.
A better pattern for links you may need to revoke
Do not hand out a long-lived presigned URL. Give people a link to your app, check permission there on every request, and only then redirect to a presigned URL that lives for a minute or two. You can revoke the app link instantly because it is a row in your database. See designing share links you can revoke.
Google Cloud Storage V4 signed URLs follow the same rules: a 7-day maximum and no per-URL revoke, so the levers are the same (permission, key, object).
Related
Removed someone but they can still see the file · Designing share links you can revoke · How to revoke a JWT before it expires · HTTP 401 vs 403 · no-cache vs no-store · JWT decoder · Wirebook: does the old link still work? · Fusenote: one-time notes
Questions
Can I revoke a single S3 presigned URL?
Not by itself. S3 does not store issued URLs. You can stop it by removing the signer's permission, deactivating the signing key or session, denying old signatures with s3:signatureAge, or deleting or moving the object.
What is the maximum expiry for an S3 presigned URL?
7 days (604800 seconds) with Signature Version 4. It can expire sooner if it was signed with temporary credentials that expire first.
Why did my presigned URL expire before X-Amz-Expires?
It was probably signed with temporary credentials (a role, instance profile or SSO session). The URL stops working when those credentials expire.
If I overwrite the object, does the old presigned URL still work?
Yes, unless it named a specific versionId. It now serves the new content, which is a quiet way to leak something if you meant to revoke it. Delete or move the object instead.
Does revoking stop someone who already downloaded the file?
No. It only blocks future requests. Treat anything already downloaded as out of your hands and rotate any secrets it contained.
Published .