Amazon S3 is the AWS file store: backups, documents, images, whatever. The classic mistake is making a bucket public in order to pass a link to someone. There is no need, and it is the cause of a good share of the data leaks that make the news. S3 lets you generate a temporary link (presigned URL) to a specific file, which works for as long as you say and then stops working, with the bucket completely closed.
This guide sets up the bucket properly from the start and shows you the two ways of generating the link: with the mouse and with a command.
Before you start: what each thing means
- S3
- Amazon's file storage service. It stores any type of file and serves it when asked.
- Bucket
- A "root folder" in S3, with a name that is unique worldwide. Your files and subfolders go inside it.
- Object
- What S3 calls each stored file.
- Public access
- Anyone on the internet being able to see a file if they know its address. It is blocked by default and should stay that way.
- Presigned URL (temporary link)
- A special, long address with a signature, which allows a specific file to be downloaded for the time you choose and then stops working.
- CloudShell
- The terminal built into the AWS web console, where you type commands. Nothing to install.
- Versioning
- An option whereby S3 keeps the previous versions of a file when you change or delete it.
- Lifecycle rule
- An automatic clean-up rule: delete old versions or files after a number of days.
- CloudFront
- Amazon's content delivery network: the right way to serve files from a bucket to the public without opening the bucket.
Step by step
Create the bucket with public access blocked
In the S3 console, Create bucket. The name is unique across all of AWS, so use something like
copias-miempresa-2026, in lower case and without spaces. Choose the region where you have the rest of your things. Under Block Public Access settings leave the Block all public access box ticked: it is the default and it is the right one. Further down, turn on default encryption (SSE-S3 is enough) and, if you are going to store important things, versioning, which keeps the previous versions of a file when you overwrite or delete it.Upload the file
Go into the bucket, Upload, drag the file in and press Upload. You can create folders to keep things tidy; in S3 folders are just part of the file name, but in the console they work as you would expect. When it finishes, click on the file: you will see its Object URL. If you open it in the browser it will give you "Access Denied". Perfect: that means the bucket is closed.
Generate the temporary link from the console
With the file selected, Actions menu, Share with a presigned URL. Choose how long it should work (minutes or hours; the console has a maximum of a few hours) and press Create. The URL is copied to the clipboard. It is long and carries a signature: anyone who has it can download that file until it expires, and nothing else.
Or generate the link from CloudShell
If you need it often or want a longer period, open CloudShell (the terminal icon in the console) and type:
aws s3 presign s3://copias-miempresa-2026/informes/octubre.pdf --expires-in 86400The number is in seconds: 86400 is one day. The link it returns can be pasted into an email or a chat. The maximum period depends on the type of credential you sign it with; with an IAM user access key it can be up to a week.
Hand over the link and check that it expires
Send it to whoever needs to download the file. Once the period is over, the link returns a "Request has expired" error. If someone needs it again, you generate another one: it takes a moment. There is no need to delete or change anything in the bucket.
If you have inherited a public bucket, close it
In the bucket list, the Access column tells you whether any is public. Go into it, Permissions tab, turn on Block all public access and remove the bucket policy that was opening it. Then, for files that really do have to be public (images for a website, for example), the right thing is to serve them through CloudFront, not to open the bucket.
What can go wrong
The link gives "Access Denied" instead of downloading
The presigned URL works with the permissions of whoever signed it. If your user cannot read that object, neither can the link. It also happens if the URL was copied incomplete: it is very long and some email clients cut it. Send it as a link, not as plain text, or shorten it with a trusted service.
The link expires sooner than I asked for
If you generated it from CloudShell or with temporary credentials (a role), the URL stops working when those credentials expire, even if you asked for more time. For long periods, sign it with the key of an IAM user that only has read permission on that bucket.
The bucket name already exists
Names are global: another AWS customer somewhere in the world is already using it. Add your company name or a suffix.
The S3 bill grows without uploading anything
With versioning on, deleting a file does not delete it: it creates a "delete marker" and the previous version keeps taking up space. Set a lifecycle rule that removes old versions after a few days. Incomplete multipart uploads also take up invisible space; another lifecycle rule cleans them up.
In Simplio
In Simplio you open the bucket like a folder: you upload, download and delete files without going into the AWS console, and each person on your team sees only the buckets you assign them and can or cannot delete depending on the permission you give them. Blocked public access stays blocked: Simplio never opens a bucket.
The same task, in AWS and in Simplio
| In the AWS console | In Simplio | |
|---|---|---|
| Uploading and organising files | S3 console, bucket by bucket, account by account | Buckets from all your accounts as folders on one screen |
| Giving a team member access | IAM user with a hand-written S3 policy | Assign them the bucket and tick whether they can delete |
| Knowing who deleted a file | CloudTrail with data event logging turned on (cost) | Simplio activity log, by person and bucket |