AWS S3 Support
Fix S3 presigned URL errors.
Presigned URLs fail in confusing ways: SignatureDoesNotMatch, Request has expired, or AccessDenied on a URL that looked fine a minute ago. Most causes are short-lived credentials, a signed header that the client changes, or a Region mismatch. We reproduce the failure and fix the signing code.
When You Need This
The situations where this work pays for itself.
Signs it is time
- Users get SignatureDoesNotMatch when downloading or uploading
- Links expire sooner than the expiry you set
- Browser uploads work in Postman but fail from the web app
- URLs generated by Lambda or ECS stop working after some time
- Objects encrypted with KMS cannot be fetched through a presigned URL
What you get
- Root cause for each failure type with a reproduction
- Corrected signing code and credential strategy
- Bucket CORS configuration for your web origins
- A short guide to expiry limits and header rules for your developers
How we do it
A clear, safe process you can follow along with.
1. Read the XML error body
S3 returns a specific code: SignatureDoesNotMatch, ExpiredToken, AccessDenied or Request has expired. The body also includes the string S3 expected to sign, which shows what differs.
2. Check which credentials signed the URL
A presigned URL is valid only while the credentials that signed it are valid. URLs signed by an IAM role, Lambda, ECS task or STS session stop working when that session ends, whatever expiry you requested.
3. Check what the signer is allowed to do
The URL carries the signer's permissions. If that role lacks s3:GetObject or s3:PutObject, or kms:Decrypt for the key, the URL returns AccessDenied even though it is syntactically valid.
4. Match headers and parameters
Any header included in the signature, such as Content-Type or x-amz-server-side-encryption, must be sent unchanged by the client. We align the signing call with exactly what the browser or SDK sends.
5. Fix Region and endpoint issues
We sign with the bucket's Region and a Signature Version 4 client. A wrong Region or a path-style versus virtual-host mismatch causes signature failures or redirects.
6. Configure CORS for browser uploads
Browser clients need a CORS rule on the bucket allowing the origin, method and headers, and the preflight must succeed before the PUT or POST is sent.
7. Test end to end
We test from the real client, including clock skew checks, and add logging of the signer identity and expiry so future failures are quick to diagnose.
Mistakes we help you avoid
Common ways this goes wrong, and what we do instead.
Assuming expiry is whatever you pass in
Temporary credentials cap the real lifetime. Long-lived links need a different design, such as a signing service or CloudFront signed URLs.
Changing Content-Type on the client
If the type was signed, a different value breaks the signature.
Sharing presigned URLs as permanent links
Anyone with the URL has access until expiry. Use short expiries and scope them to one key.
Frequently Asked Questions
Why is my S3 presigned URL expiring early?
The signing credentials probably expire first. A role session or temporary credentials limit the URL lifetime to the session lifetime, regardless of the expiry you set.
What causes SignatureDoesNotMatch on a presigned URL?
Common causes are altered signed headers, the wrong Region or signing version, changed query parameters, a URL-encoding mistake or a client clock far off from real time.
Can I use a presigned URL for a KMS-encrypted object?
Yes, as long as the signing identity has the needed KMS permissions and the URL is generated with Signature Version 4.
Want Help With Fix S3 presigned URL errors?
Schedule an appointment. Tell us about your environment and we will outline the safest, highest-value approach.
Schedule Appointment › No commitment required