While working with AWS and FastAPI, I wanted a simple yet secure way for users to upload and download files directly from S3. That curiosity led me to build a project called s3-presigned-url-api
, a FastAPI application that generates temporary S3 presigned URLs for secure file management.

In this article, I’ll walk you through how presigned URLs work, how I implemented them in FastAPI, and what security practices you should follow when using them in production.

What Are Presigned URLs

A presigned URL is a temporary signed link that gives limited access to an S3 object. You can use it for uploads, downloads, or deletions without needing to expose AWS access keys.

Here’s how the flow works:

Client → FastAPI → AWS S3 (presigned URL) → Client → S3 (upload/download)
Your backend (FastAPI) requests a presigned URL from AWS, signs it with your credentials, and returns it to the client. The client can then upload or download directly from S3 for a limited time, usually a few minutes.

Setting Up the Project
Requirements

• Python 3.9+
• FastAPI
• boto3
• uvicorn
• python-dotenv

Install dependencies:

pip install fastapi boto3 uvicorn python-dotenv

Environment Variables

Create a .env file in your project directory:

AWS_ACCESS_KEY_ID=your_aws_access_key
AWS_SECRET_ACCESS_KEY=your_aws_secret_key
AWS_REGION=us-east-1
S3_BUCKET_NAME=your_bucket_name
PRESIGNED_URL_EXPIRATION=600

FastAPI Code Example
s3_service.py

This module handles presigned URL generation using boto3.

`import boto3
from botocore.exceptions import ClientError
from dotenv import load_dotenv
import os

load_dotenv()

s3_client = boto3.client("s3", region_name=os.getenv("AWS_REGION"))

def create_presigned_url(bucket_name, object_name, expiration=600, method="put_object"):
try:
response = s3_client.generate_presigned_url(
ClientMethod=method,
Params={"Bucket": bucket_name, "Key": object_name},
ExpiresIn=expiration
)
except ClientError as e:
print(e)
return None
return response`

main.py

The FastAPI app exposes endpoints for upload and download URLs.

`from fastapi import FastAPI, Query
from s3_service import create_presigned_url
import os

app = FastAPI()

@app.get("/generate-upload-url")
def generate_upload_url(filename: str = Query(..., description="Name of the file to upload")):
url = create_presigned_url(os.getenv("S3_BUCKET_NAME"), filename, method="put_object")
return {"upload_url": url}

@app.get("/generate-download-url")
def generate_download_url(filename: str = Query(..., description="Name of the file to download")):
url = create_presigned_url(os.getenv("S3_BUCKET_NAME"), filename, method="get_object")
return {"download_url": url}`

Run the app:

uvicorn main:app --reload

You can now visit:

/generate-upload-url?filename=myfile.png

/generate-download-url?filename=myfile.png

to generate presigned links for uploads and downloads.

How the Upload Works

1.The client requests a presigned upload URL from your FastAPI endpoint.
2.FastAPI calls S3 through boto3 to generate a signed URL that expires in 10 minutes.
3.The client uploads the file directly to S3 using that URL.

Example upload with curl:

curl --upload-file ./test.png "$(curl -s 'http://localhost:8000/generate-upload-url?filename=test.png' | jq -r .upload_url)"

Security Considerations
Presigned URLs are powerful but must be used carefully:

• Use short expiration times, around 5 to 10 minutes
• Validate file types before allowing uploads
• Apply least privilege to IAM roles and users
• Enable server-side encryption for all uploaded files
• Log and monitor presigned URL requests for auditing

Infrastructure and Deployment
-This project includes support for:
-Docker for containerization
-Terraform for provisioning AWS resources

Kubernetes manifests for orchestration if you deploy to EKS or similar

Example Docker command:

docker build -t s3-presigned-url-api .
docker run -p 8000:8000 s3-presigned-url-api

Future Improvements
Here’s what I plan to add next:

• JWT authentication to restrict who can generate URLs
• Logging and metrics for observability
• Automatic file cleanup with S3 lifecycle policies
• Rate limiting to prevent abuse

Conclusion

Working with S3 presigned URLs has been a great learning experience. It’s a simple and secure way to handle file uploads and downloads in a cloud-native architecture. FastAPI makes it easy to expose these capabilities with clean and lightweight endpoints.

You can check out the complete source code on GitHub:
https://github.com/Copubah/s3-presigned-url-api