Question

A media company allows authenticated users to download purchased video files stored in a private S3 bucket. A backend application running on an EC2 instance (using an IAM role) generates S3 presigned URLs so users can download objects directly. Security testing reveals that some presigned URLs configured with a 7-day expiration stop working after only a few hours. What is the MOST likely cause of this behavior?

Accepted Answer

The presigned URLs were signed with temporary security credentials from the instance role, and they expire when those temporary credentials expire, regardless of the requested expiration time.

Answer

S3 presigned URLs have a hard maximum lifetime of 6 hours that cannot be exceeded under any signing method.

Answer

The bucket's default encryption with SSE-KMS invalidates presigned URLs once the KMS key rotates.

Answer

S3 Block Public Access is silently revoking the presigned URLs because they grant anonymous access to objects.