S3 Viewer
Open app

How to share an S3 file with a non-technical user

TL;DR

Two patterns. Copy a presigned URL — a time-limited bearer link that works in any browser without an AWS account; S3 Viewer's Copy link gives you one that lasts 15 minutes. Or invite the recipient to the server by email — tied to a logged-in user, given a role, revocable in one click. Use a link for one-off shares; use an invite for ongoing access.

Steps

Step-by-step.

  1. 01

    Decide: one-time or ongoing access?

    One-time: a presigned URL is the right tool — short-lived, no signup, works in any browser. Ongoing: an email invite to the server is safer — tied to a logged-in user, given a role, revocable in one click.
  2. 02

    One-time: presigned URL via the AWS CLI

    The link works in any browser and expires after the duration you set (max 7 days with IAM user keys). It's a bearer token — anyone who gets the link can use it until it expires, and it can't be revoked once shared.
    aws s3 presign s3://my-bucket/contract.pdf --expires-in 3600
  3. 03

    One-time: Copy link in S3 Viewer

    Open the ⋮ menu on the object's row and choose Copy link. S3 Viewer signs a presigned URL server-side with the server's stored credentials and puts it on your clipboard. It is valid for 15 minutes — long enough to paste into a message, short enough that a leaked link stops working quickly.
  4. 04

    Ongoing: invite them to the server

    Open the server's bucket list and click Share to open the members dialog. Type the recipient's email and choose Viewer (browse and download), Editor (also upload, rename, delete and create buckets where supported) or Admin (also manage members, rename the server and remove buckets). They sign in with the code and sign-in link we email them — or with GitHub, if it is enabled — and see the buckets on that server.
  5. 05

    Roles are per server, and per bucket where you need it

    A member's role on the server is their baseline, and a bucket can give the same person a different role. Simpler to operate than authoring per-person IAM users with hand-rolled JSON policies.
  6. 06

    Revoke when done

    Remove them from the members dialog. They stop being able to reach the server on their next request — no IAM key rotation needed, because no IAM user was ever minted for them.

Under the hood

What's actually happening.

A presigned URL is a signed query-string version of an S3 GET request. Anyone with the link can fetch the file until it expires (max 7 days with IAM user keys; S3 Viewer issues 15-minute ones). It's a bearer token — leaking the URL leaks the file, and it can't be revoked once it's out.


An invite ties access to a logged-in user, which means you can revoke at any time, give them a role, and avoid minting IAM users. S3 Viewer signs every request server-side with the server's stored credentials — encrypted in your browser before they reach us — so the recipient never sees an access key. Off-boarding is a one-click revoke: no AWS keys to rotate, because no IAM user was ever created.

FAQ

Common questions.

How do I send an S3 file to a client who doesn't use AWS?

Quickest: open the ⋮ menu on the file in S3 Viewer and choose Copy link — that's a presigned URL valid for 15 minutes, and it works in any browser. From the CLI the equivalent is aws s3 presign s3://bucket/key --expires-in 3600. For repeat access, invite them to the server by email — they sign in once and see the buckets you gave them, with no AWS account, IAM user or CLI required.

Are presigned URLs safe to share?

Safe enough for short-lived sharing — they expire and don't expose your credentials. Less ideal for ongoing access: anyone who gets the link can use it until it expires, it can't be revoked once shared, and there's no record of who actually downloaded the file. For ongoing access, an email invite is the right primitive — revocable, tied to a signed-in user, no permanent IAM artifacts.

How long can a presigned URL last?

AWS allows presigned URLs to last up to 7 days when signed with IAM user credentials, or up to the session length when signed with temporary credentials (typically 1 hour for STS). Shorter is safer. Every URL S3 Viewer issues — Copy link, downloads, previews — lasts 15 minutes, and that is not configurable. Uploads don't use presigned URLs at all: they stream through the S3 Viewer server into the bucket.

Can I revoke a presigned URL after sharing it?

Not directly. The options are to wait for it to expire, rotate the signing key (which invalidates every other URL signed with that key), or delete the underlying object. This is why invites exist — access is tied to a signed-in user, not a token, so revoking takes one click and breaks nothing else. S3 Viewer's links expire after 15 minutes, which keeps the window small.

Can the recipient upload back to me?

Yes — presigned URLs can be issued for PUT as well, but they're clunky for repeat use. In S3 Viewer, give them the Editor role and they can upload through the file browser.

Does this work with Cloudflare R2 too?

Yes. R2 supports the same S3 presigned URL pattern, and invites work identically on a server pointed at R2 — useful when you want to share an R2 bucket with someone who doesn't have a Cloudflare account.

Use S3 Viewer for this

Skip the CLI. Try it in the browser.

S3 Viewer turns the steps above into a single click. Open source, self-hostable, free.

Open appStar on GitHub