Question 1401

Seven Days Or Six Hours

A service running on EC2 under an instance profile mints presigned PUT URLs with ExpiresIn=604800 (seven days) and emails them to customers so they can upload documents. Customers who click within the hour are fine. Everyone else gets ExpiredToken, usually after a few hours, with no pattern anyone can tie to the seven day window. What is going on?

A

Role credentials can only sign GET presigned URLs. A presigned PUT requires long-term IAM user keys, and the ones that work are being retried by clients that fall back to a direct upload.

B

The URL is signed with the instance profile's temporary credentials and dies when they expire or when ExpiresIn passes, whichever is first. EC2 metadata credentials last about six hours.

C

S3 caps presigned URL lifetime at twelve hours regardless of what the SDK asks for, so the seven day value is silently clamped.

D

The mail client rewrites outbound links for click tracking, which alters the query string and invalidates the signature.