S3 Presigned URL is valid for 7 days, but the role it's associated with is only 12 hours. Is it possible to make it last the actual stated 7days?

Question

Despite creating a pre-signed URL valid for 7 days, it will never last for more than 12 hours because the role token expires. This seems to be a problem a lot of people experience.

Am I missing something? What's the point of having a 7-day expiry on the pre-signed URL?

Brettski-AWS · Answer

This is [covered in the documentation](https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-presigned-url.html):

> To create a presigned URL that's valid for up to 7 days, first delegate IAM user credentials (the access key and secret key) to the method you're using to create the presigned URL.

If you are going to create an IAM user with long-lived credentials I'd strongly recommend storing those credentials somewhere that you can limit access to (Secrets Manager or Parameter Store are a good start); and scope the credentials down so that they can only perform the S3 operation(s) that the presigned URL will be created for.

S3 Presigned URL is valid for 7 days, but the role it's associated with is only 12 hours. Is it possible to make it last the actual stated 7days?

Relevant content