S3 pre-signed URLs in Spring Boot

Many applications either expose S3 files publicly or force every file request through the backend server. Both approaches create security, scalability, or performance problems.

Pre-signed URLs solve this by allowing controlled temporary access directly from S3 while keeping authorization inside your backend.

What are S3 pre-signed URLs

A pre-signed URL is a temporary link that allows access to a specific file in S3.

• generated by your backend
• valid for a limited time
• grants controlled access to a file

Why use S3 pre-signed URLs

• avoid making files publicly accessible
• reduce load on your backend server
• provide time-limited access
• improve scalability

How S3 pre-signed URLs work in Spring Boot

Where to generate pre-signed URLs

URL generation should happen in your backend, not on the client.

• validate user identity first
• check file ownership or permissions
• generate URL only if authorized

import java.net.URL;
import java.time.Duration;

import software.amazon.awssdk.services.s3.model.GetObjectRequest;
import software.amazon.awssdk.services.s3.presigner.S3Presigner;
import software.amazon.awssdk.services.s3.presigner.model.GetObjectPresignRequest;
import software.amazon.awssdk.services.s3.presigner.model.PresignedGetObjectRequest;

GetObjectRequest getObjectRequest = GetObjectRequest.builder()
    .bucket(bucketName)
    .key(objectKey)
    .build();

GetObjectPresignRequest presignRequest = GetObjectPresignRequest.builder()
    .signatureDuration(Duration.ofMinutes(15))
    .getObjectRequest(getObjectRequest)
    .build();

PresignedGetObjectRequest presignedRequest =
    s3Presigner.presignGetObject(presignRequest);

URL downloadUrl = presignedRequest.url();

Recommended Spring Boot S3 file access structure

Keeping authentication, storage, and URL generation separated makes secure file systems easier to maintain.

src/
 ├── controller/
 ├── security/
 ├── service/
 ├── storage/
 ├── s3/
 └── config/

Why public S3 file access becomes a security problem

Many applications expose S3 files publicly because it simplifies downloads. This becomes risky when handling private or user-specific content.

• files become accessible without authentication
• private content can leak through shared URLs
• access control becomes difficult to enforce
• backend authorization logic gets bypassed

Pre-signed URLs solve this by keeping authorization inside your backend while allowing temporary secure access directly from S3.

Controlling access duration

Pre-signed URLs should always have an expiration time.

• short duration for sensitive files
• longer duration for public-like content
• balance between usability and security

Common mistakes to avoid

• generating URLs without authorization checks
• using very long expiration times
• exposing raw S3 paths
• mixing URL generation with controller logic

When to use S3 pre-signed URLs

• secure file downloads
• user-specific file access
• scalable file serving systems

Without vs with pre-signed URLs