If you are using Amazon Web Services Cloud, good chance that you are using S3 for your document and image management needs. And if you application is end-user facing there probably is a need to allow user to download certain files from you private S3 buckets.
We never read the entire manual ever, so naturally we face with question how to allow downloading files from S3 buckets when the end user doesn't have access to it. Even if we want to give temporary access to end user it is not practical when you have large number of users.A most obvious, but less elegant solution will be to first download the file to your server and then stream to your user. But that requires unnecessary IO, memory and extra processing.
Pre-signed URLs offer a more elegant solution that is highly maintainable.
Presented by: http://www.aws-simplified.com/aws/aws-s3/allow-download-of-files-from-amazon-s3-without-giving-access-to-bucket
2. AWS S3 Pre-signed URLs
The Pre-signed time-bound URLs allow you
to let your end users:
Download files from you Amazon S3 private
bucket
Within certain time-limit
Without need for additional credentials.
3. Highly Simplified Use Case
Step 1: A user requests to download a file
through your business application.
He has no knowledge of your Amazon S3
buckets
Just like all documents, this file is stored on
the Amazon S3 bucket.
11. Highly Simplified Use Case
Step 5: User download the file
User clicks on the link. Now two things can happen
User may click the link within 10 seconds from the
time it was created: he will be able to download
the file. Because the link was created using
Amazon S3 APIs, S3 bucket very well knows that
this download request is pre-authenticated. It lets
user download the file.
User clicks the link after 10 seconds: User gets error
and no file is downloaded.
