What is difference between Pre-Signed Url and Signed Url?

Pre-Signed URLs vs. Signed URLs: Securing Access to Cloud Resources

Explore the differences between Pre-Signed URLs and Signed URLs, their use cases, and how they enhance security for resources hosted on AWS S3 and CloudFront.

When working with cloud storage and content delivery networks like Amazon S3 and Amazon CloudFront, securely granting temporary access to private resources is a common requirement. AWS provides two primary mechanisms for this: Pre-Signed URLs and Signed URLs. While both serve the purpose of controlled access, they differ significantly in their implementation, use cases, and the services they are typically associated with. Understanding these distinctions is crucial for designing robust and secure cloud applications.

What is a Pre-Signed URL?

A Pre-Signed URL is a URL that you generate using your AWS security credentials to grant temporary access to a specific S3 object. The person who receives the Pre-Signed URL can then use it to either upload or download the object, depending on the permissions granted when the URL was created. This URL is valid only for a limited time, which you specify when generating it. It's ideal for scenarios where you want to allow a user to directly interact with S3 without exposing your AWS credentials or requiring them to have an AWS account.

sequenceDiagram
    participant App as Your Application
    participant S3 as Amazon S3
    participant User as End User

    App->>S3: Request Pre-Signed URL for object (e.g., PUT/GET)
    S3-->>App: Returns Pre-Signed URL
    App->>User: Provides Pre-Signed URL
    User->>S3: Uses Pre-Signed URL to directly access object (e.g., upload/download)
    S3-->>User: Grants access (if URL is valid and not expired)

Flow of a Pre-Signed URL for direct S3 object access

Key Characteristics of Pre-Signed URLs

Pre-Signed URLs are primarily associated with Amazon S3. They offer direct access to S3 objects, bypassing your application for the actual data transfer. This can be beneficial for offloading traffic from your application server and improving performance for large file transfers. The security of a Pre-Signed URL relies on the temporary nature of its validity and the fact that it's generated with your credentials, which are not exposed to the end-user. Once generated, the URL itself contains all the necessary authorization information, including the signature and expiration time.

using Amazon.S3;
using Amazon.S3.Model;

public class S3PreSignedUrlGenerator
{
    private readonly IAmazonS3 _s3Client;

    public S3PreSignedUrlGenerator(IAmazonS3 s3Client)
    {
        _s3Client = s3Client;
    }

    public string GeneratePreSignedURL(string bucketName, string objectKey, TimeSpan duration)
    {
        var request = new GetPreSignedUrlRequest
        {
            BucketName = bucketName,
            Key = objectKey,
            Expires = DateTime.UtcNow.Add(duration),
            Verb = HttpVerb.GET // Or HttpVerb.PUT for uploads
        };

        string url = _s3Client.GetPreSignedURL(request);
        return url;
    }
}

C# example for generating an S3 Pre-Signed URL for GET operation.

What is a Signed URL?

A Signed URL, in the context of AWS, is typically associated with Amazon CloudFront. CloudFront Signed URLs allow you to control access to content that you're serving through a CloudFront distribution. Unlike S3 Pre-Signed URLs, which grant direct access to S3, CloudFront Signed URLs ensure that all requests for the content go through CloudFront. This allows you to leverage CloudFront's caching capabilities, edge locations, and additional security features like geo-restriction or IP whitelisting, even for private content.

sequenceDiagram
    participant App as Your Application
    participant CF as Amazon CloudFront
    participant S3 as Amazon S3 (Origin)
    participant User as End User

    App->>CF: Request Signed URL for content
    CF-->>App: Returns Signed URL (with policy/signature)
    App->>User: Provides Signed URL
    User->>CF: Uses Signed URL to request content
    CF->>S3: Fetches content from origin (if not cached)
    S3-->>CF: Returns content
    CF-->>User: Delivers content (if URL is valid and policy met)

Flow of a CloudFront Signed URL for content delivery

Key Characteristics of Signed URLs

CloudFront Signed URLs offer more granular control over access policies. You can define a custom policy that specifies not only an expiration time but also a start time, IP address range, and even specific URL paths. This makes them suitable for scenarios like streaming video, distributing premium content, or providing temporary access to software downloads where you need more sophisticated access control than a simple time-based expiration. To generate a CloudFront Signed URL, you need a CloudFront key pair (public and private keys) and a trusted key group configured in your CloudFront distribution.

using Amazon.CloudFront;
using Amazon.CloudFront.Model;

public class CloudFrontSignedUrlGenerator
{
    private readonly string _privateKeyFilePath;
    private readonly string _keyPairId;
    private readonly string _domainName;

    public CloudFrontSignedUrlGenerator(string privateKeyFilePath, string keyPairId, string domainName)
    {
        _privateKeyFilePath = privateKeyFilePath;
        _keyPairId = keyPairId;
        _domainName = domainName;
    }

    public string GenerateSignedURL(string objectPath, TimeSpan duration)
    {
        var policy = new CustomPolicy
        {
            Resource = $"https://{_domainName}/{objectPath}",
            ExpiresOn = DateTime.UtcNow.Add(duration),
            // Optional: ActiveFrom = DateTime.UtcNow,
            // Optional: IpAddress = "192.168.1.1/32"
        };

        string signedUrl = AmazonCloudFrontUrlSigner.Get = AmazonCloudFrontUrlSigner.Get = AmazonCloudFrontUrlSigner.GetSignedURLFromCustomPolicy(
            policy,
            _privateKeyFilePath,
            _keyPairId
        );

        return signedUrl;
    }
}

C# example for generating a CloudFront Signed URL with a custom policy.

Comparison Summary

Here's a quick overview of the key differences between Pre-Signed URLs and Signed URLs:

Pre-Signed URLs vs. Signed URLs: A quick comparison

In summary, Pre-Signed URLs are simpler and grant temporary direct access to S3 objects, making them suitable for direct uploads/downloads. Signed URLs, on the other hand, are more powerful and integrate with CloudFront, offering advanced access control policies and leveraging the CDN's benefits for content delivery. Your choice depends on your specific security, performance, and access control requirements.