Security
3 articles on Security.
Presigned POST: cap size and type before the upload starts
A presigned PUT signs a URL, not a byte count. A POST policy adds a size range and a content-type condition that S3 enforces while the body arrives.
Presigned URLs expire at seven days. Then what?
Seven days is not a setting: it is how long the SigV4 signing key lives. What happens at that wall, and the three patterns that outlive it.
When two policies allow and the request still fails
S3 returns AccessDenied even when the bucket and IAM policies both allow. Here is the five-gate evaluation order and where the hidden deny sits.