Read what a presigned URL actually grants. The signature is never shown, never exported and never leaves this page.
Or drop a file anywhere on this panel. Nothing is uploaded: the analysis runs in this tab.
The answer appears here
Paste on the left and press Decode. Nothing leaves this tab.
Nothing else to flag.
No formatting problems, and nothing the rules object to. Worth remembering what that covers: this reads the file you pasted, not the account or cluster it will be applied to.
No finding matches that filter.
Real input you can load into the tool above. Each one shows a different thing going wrong, because that is what the tool is for.
The session expires long before the URL claims to
https://example-bucket.s3.eu-west-1.amazonaws.com/reports/q1.pdf?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=ASIAIOSFODNN7EXAMPLE%2F20260101%2Feu-west-1%2Fs3%2Faws4_request&X-Amz-Date=20260101T120000Z&X-Amz-Expires=86400&X-Amz-SignedHeaders=host&X-Amz-Signature=example
Over the SigV4 ceiling, and refused with an error about the parameter
https://example-bucket.s3.eu-west-1.amazonaws.com/reports/q1.pdf?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIOSFODNN7EXAMPLE%2F20260101%2Feu-west-1%2Fs3%2Faws4_request&X-Amz-Date=20260101T120000Z&X-Amz-Expires=691200&X-Amz-SignedHeaders=host&X-Amz-Signature=example
A bearer credential in browser history for seven days
https://example-bucket.s3.eu-west-1.amazonaws.com/reports/q1.pdf?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIOSFODNN7EXAMPLE%2F20260101%2Feu-west-1%2Fs3%2Faws4_request&X-Amz-Date=20260101T120000Z&X-Amz-Expires=604800&X-Amz-SignedHeaders=host&X-Amz-Signature=example
These are the ones that fail silently. The config is accepted, nothing raises an error, and the consequence arrives later.
Those credentials are temporary, so the URL stops working when the session behind it expires, typically within the hour, and X-Amz-Expires says nothing about it.
Instead:Sign with a credential that outlives the link, or accept the shorter life and re-sign on demand.
It is a bearer credential. It works from anywhere, for anyone, until it expires, and it ends up in browser history and proxy logs.
Instead:Sign for minutes, not days, and generate on demand rather than storing links.
There is no revoke call, so nothing you do to the URL matters.
Instead:Remove the signing principal's permission to the object, or rotate the credential. Both affect more than the one link, which is the point.
X-Amz-Expires is a request, not a guarantee. If the signer was a role, an EC2 instance profile or a Lambda, the link stops working when that session ends, which is often an hour and is written nowhere in the URL.
ASIA is a temporary session and AKIA is a permanent IAM user key. That single distinction decides whether the seven day expiry you asked for is real.
Anything longer is refused with AuthorizationQueryParametersError, which names the parameter rather than the limit, so it reads as a signing bug rather than a value that is too large.
There is no API call for it. The only ways to stop one are to remove the signer's permission to the object, rotate or delete the credential that signed it, or delete the object. Short expiries are the only control you have once the link is out.
Signing narrows nothing. A presigned PUT made by a role with s3:* is a write with that role's authority, and whoever holds the link never authenticates as themselves. Sign with a role scoped to the one object and the one action.
For an upload URL with only host signed, the uploader chooses the Content-Type, so the stored object can claim to be text/html. A presigned POST policy can constrain the type and the size; a presigned PUT cannot.
With "Request has expired" in the body, which is easy to read as a permissions problem and send somebody looking at IAM. Nothing about the bucket or the object needs changing.