Question

A photo-sharing web application allows authenticated users to upload images directly to a private Amazon S3 bucket from their browsers. For security, the application must not expose long-lived AWS credentials to the client, and each upload authorization should be valid only for a short time. The backend runs on AWS Lambda with an execution role that has s3:PutObject permission on the bucket. What is the MOST appropriate way to grant browsers temporary permission to upload?

Accepted Answer

Have the Lambda function generate a pre-signed S3 URL with a short expiration and return it to the browser, which then performs the upload directly to S3.

Answer

Create an IAM user with s3:PutObject permission, embed its access keys in the JavaScript, and rotate the keys weekly.

Answer

Make the S3 bucket public for writes and rely on the application to validate uploads afterward.

Answer

Attach a bucket policy that allows s3:PutObject from any principal and restrict access using CORS configuration only.