Do pre-signed s3 urls using transfer accelerating always go over the public internet?

Question

So our current infrastructure always generates pre-signed transfer accelerating links on an API (links like `https://.s3-accelerate.amazonaws.com/?...`). These are generated by an API hosted on AWS. These links are used to download files by different services:

- services hosted on our AWS infrastructure
- services hosted on 3th party clients AWS infrastructure
- services outside of AWS

It is however not clear to us when these files would be downloaded through the public internet or stay within the AWS infrastructure. The files are quite large so we thus would like to only go through the public internet if needed. I was thus wondering in which cases we can stay within AWS and if we can always use transfer accelerating links or should use normal presigned URLs when we are downloading from within AWS.

Answer

According to https://docs.aws.amazon.com/AmazonS3/latest/userguide/transfer-acceleration.html:

> Transfer Acceleration is designed to optimize transfer speeds from across the world into S3 buckets. Transfer Acceleration takes advantage of the globally distributed edge locations in Amazon CloudFront. As the data arrives at an edge location, the data is routed to Amazon S3 over an optimized network path.

So transfer does go through the internet.

If you can/want to compromise with latency/speed, you can still use CloudFront pre-signed URLs: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-signed-urls.html

Do pre-signed s3 urls using transfer accelerating always go over the public internet?

관련 콘텐츠