Why use single-use tokens instead of just setting a very short presigned URL expiry?

A short expiry still leaves a bearer credential valid for its whole window, and you cannot revoke it once issued. A single-use token decouples the durable, revocable artifact (the token in DynamoDB) from the disposable one (the URL), so reuse is blocked by a database state change rather than only by a timer you cannot take back.

What actually prevents two simultaneous redemptions of the same token?

A DynamoDB conditional write. The update to mark a token used only commits if the row is still in its expected unused state, so among concurrent requests exactly one succeeds and the rest fail their condition and receive a 403. This is the single mechanism the whole pattern depends on, and it should be covered by a concurrency test.

Does the presigned URL really last 30 seconds in this architecture?

No. The source states the URL expiration is configurable at deployment time and should be very short, but never fixes a number. Thirty seconds is a generic best-practice default from the wider literature, not a property of this solution. Choose the expiry deliberately based on your file sizes and retry needs.

Why can't the system stream the file through Lambda instead of redirecting to S3?

Lambda caps both request and response payloads at 6 MB, so proxying object bytes through the function fails for any real file. The pattern redirects the client straight to S3, usually via an HTTP 302, which keeps the heavy transfer object-to-client and lets the compute layer move only tokens and a URL string.

When is S3 One Zone-IA the right storage class for token-fronted objects?

When the data is regenerable or genuinely non-critical, such as temporary exports or logs. One Zone-IA is about 57% cheaper than Standard at roughly $0.01/GB/month, but it stores a single availability zone, so a zone loss means data loss. A short URL lifetime does not change that, so never use it for data you cannot recreate.

Single-Use S3 Presigned URLs: Fix the Credential, Not the Timer

Wed, 17 Jun 2026 00:00:00 +0000

A platform team I reviewed last year had read the AWS guidance correctly and drawn exactly the wrong lesson from it. They knew presigned URLs expire, so they set every download link to the shortest window their retry logic could tolerate and called the access problem solved. Then a support engineer forwarded one of those links into a shared ticket thread to help a customer, the customer's CDN cached it, and a medical scan stayed pullable by anyone in that thread until the timer ran out.

Token on StorageNews

Single-Use S3 Presigned URLs: Fix the Credential, Not the Timer