[{"data":1,"prerenderedAt":54},["ShallowReactive",2],{"tag-security":3,"tag-all":28},[4,13,20],{"_path":5,"title":6,"description":7,"date":8,"tags":9},"\u002Fblog\u002Fpresigned-post-enforce-size-content-type","Presigned POST: cap size and type before the upload starts","A presigned PUT signs a URL, not a byte count. A POST policy adds a size range and a content-type condition that S3 enforces while the body arrives.","2026-11-01",[10,11,12],"s3","security","uploads",{"_path":14,"title":15,"description":16,"date":17,"tags":18},"\u002Fblog\u002Fpresigned-url-seven-day-ceiling","Presigned URLs expire at seven days. Then what?","Seven days is not a setting: it is how long the SigV4 signing key lives. What happens at that wall, and the three patterns that outlive it.","2026-10-31",[10,11,19],"presigned-urls",{"_path":21,"title":22,"description":23,"date":24,"tags":25},"\u002Fblog\u002Fbucket-policy-allow-still-denied","When two policies allow and the request still fails","S3 returns AccessDenied even when the bucket and IAM policies both allow. Here is the five-gate evaluation order and where the hidden deny sits.","2026-10-30",[10,26,11,27],"iam","access-control",[29,32,36,38,40,42,47,52],{"tags":30},[10,26,31,27],"governance",{"tags":33},[10,26,34,35],"sts","aws",{"tags":37},[10,26,11,27],{"tags":39},[10,11,12],{"tags":41},[10,11,19],{"tags":43},[10,44,45,46],"tutorial","tooling","seaweedfs",{"tags":48},[10,49,50,51],"pricing","cloud","cost-optimisation",{"tags":53},[10,50],1793734272750]