AWS S3 Upload Using Signed URL

Question

AWS provides SDKs on iOS and Android to upload to their servers yet you don't want your key exposed if it was decompiled. How do you prevent that? Is there a way to sign a URL on the backend and give it to the client so they can upload directly onto S3 Without exposing the key?

Answer 1

You can use Amazon STS (Security Token Service) to generate unique sign-in credentials that also expire automatically.

You can also control permissions on these temporary credentials obtained via STS (for example to allow only upload permissions in a certain S3 bucket).