Create presigned URLs in Object Storage

A presigned URL grants temporary, credential-free access to a specific object. This is useful for sharing files with external users or allowing time-limited uploads without exposing your credentials.

Prerequisites

• Object Storage enabled and credentials configured: Enable Object Storage
• AWS CLI or s5cmd installed and configured for STACKIT Object Storage

Create a presigned URL using the CLI

AWS CLI

Use the presign command to create a presigned URL for an object. The --expires-in value is in seconds:

aws s3 presign s3://my-example-bucket/testfile.txt \
  --expires-in 3600 \
  --endpoint-url https://object.storage.eu01.onstackit.cloud

This creates a URL that grants read access to testfile.txt for 3600 seconds (1 hour).

s5cmd

Use the presign subcommand to create a presigned URL for an object. The --expire value accepts a duration string (e.g. 1h, 30m):

s5cmd --endpoint-url https://object.storage.eu01.onstackit.cloud \
  presign --expire 1h \
  s3://my-example-bucket/testfile.txt

Create a presigned URL using the Python SDK

The following example uses the AWS SDK for Python (Boto3) to create a presigned URL with write access (PUT) to a specific object:

import boto3

def request_presigned_post():

    S3_ENDPOINT = "https://object.storage.eu01.onstackit.cloud"
    S3_ACCESS_KEY = "YOUR_ACCESS_KEY"
    S3_SECRET_KEY = "YOUR_SECRET_KEY"
    S3_BUCKET = "YOUR_BUCKET"
    s3key = "YOUR_FILE"

    s3client = boto3.client(
        's3',
        endpoint_url=S3_ENDPOINT,
        aws_access_key_id=S3_ACCESS_KEY,
        aws_secret_access_key=S3_SECRET_KEY,
    )

    presigned_request = s3client.generate_presigned_url(
        'put_object',
        Params={'Bucket': S3_BUCKET, 'Key': s3key},
        ExpiresIn=3600,
    )
    print(presigned_request)

def main():
    request_presigned_post()

if __name__ == "__main__":
    main()

For full details on generating presigned URLs, see the Boto3 documentation.