Presigned URLs: Secure Gated Downloads

The problem

You want to email someone a download link for a file without making the bucket public. S3’s answer: a presigned URL — a normal private object + a time-limited, signed link.

Generate one (Java v2)

import software.amazon.awssdk.services.s3.presigner.*;

S3Presigner presigner = S3Presigner.create();

PresignedGetObjectRequest presign = presigner.presignGetObject(
    GetObjectPresignRequest.builder()
        .signatureDuration(Duration.ofMinutes(15))
        .getObjectRequest(GetObjectRequest.builder()
            .bucket("groovygrails-books").key("books/java.pdf").build())
        .build());

String downloadUrl = presign.url().toString();
// hand downloadUrl to the browser/email; it expires in 15 minutes.

Why developers love it

• Bucket stays private — no public ACLs, no policy exposure.
• Time-boxed: 15–60 minutes and the link dies.
• Fine-grained: one object, one user, one window.
• Serverless — the file never streams through your app, so Tomcat does not carry the IO.

Perfect for gated book downloads, invoice invoices-pdf links or “report ready” emails from your Spring Boot back end.