How to share S3 files without making the bucket public

You can share files from Amazon S3 without ever making the bucket public. Keep it private, leave Block Public Access on and give people signed access to specific objects instead: a presigned URL for a one-off file, CloudFront signed URLs when you already run a CDN in front of the bucket, or a share link that adds a password, an expiry date and a download limit. All three work the same way on S3-compatible providers such as Cloudflare R2, DigitalOcean Spaces, Wasabi and Backblaze B2 (CloudFront is AWS only).

Secure S3 file sharing options at a glance

Why not just make the file public

The quickest way to share a file from S3 is to make it public and send the object URL. It is also the riskiest: anything public can be fetched by anyone who finds or guesses the address, with no password, no expiry and no record of who took it. Leftover public buckets are a classic source of data leaks, and they expose file names as well as contents.

AWS states that new buckets, access points and objects do not allow public access by default. On top of that, S3 Block Public Access has four settings (BlockPublicAcls, IgnorePublicAcls, BlockPublicPolicy and RestrictPublicBuckets) that override any policy or ACL that would open the bucket later. They can be set per bucket, per account or for a whole AWS Organization, and S3 applies the most restrictive combination. AWS recommends turning all four on at account level unless you really host public content, such as a static website.

Keep that switch on. Everything below works with it enabled.

Option 1: presigned URLs

A presigned URL is an object URL with a signature in the query string. It grants one operation (usually a download) on one object until it expires, and S3 checks the signature on every request.

aws s3 presign s3://my-bucket/reports/q3.pdf --expires-in 86400

That URL works for 24 hours. The CLI default is one hour and the maximum is 604,800 seconds (7 days) when you sign with IAM user keys. If you sign with temporary credentials, such as an assumed role, the URL dies when those credentials expire.

What you get:

• No change to the bucket or its policies.
• Precise control: one object, one method, one expiry.
• Works on any provider that supports SigV4 presigning.

What you do not get:

• No password. Whoever has the URL can use it, as many times as they like, until it expires.
• No download limit and no per-link revocation. You can only kill a URL early by revoking the keys that signed it.
• No folders. You sign object by object, so sharing a folder of 300 files means 300 URLs.
• Privacy of names. The URL shows your bucket name, the object key and your access key ID.

For the mechanics in depth, including uploads, each X-Amz-* parameter and SDK code, see S3 presigned URLs explained.

Option 2: CloudFront signed URLs and signed cookies

If you already serve the bucket through Amazon CloudFront, you can require signed URLs or signed cookies on a cache behavior. The bucket stays private behind origin access control (OAC), which AWS recommends over the older origin access identity: a bucket policy lets only your distribution read the objects. You register public keys in a trusted key group and sign with the matching private key.

• Signed URLs suit individual files. With a custom policy you can also set a start time and an IP range, and reuse one policy for many files with wildcards. They can be short-lived or last for years.
• Signed cookies suit many files at once, such as every segment of a video, without changing your URLs.

This is the right tool when you run an application that already authenticates users and serves content at scale. For handing a few files to people outside your team, it means setting up a distribution, managing keys and writing code that signs each request.

Restricting a bucket policy to a fixed IP range is another native option, but it only helps when you know the recipients’ networks, which is rarely the case with people outside your organization.

Option 3: share links with Nubbo

Nubbo connects to your bucket and gives you share links with the controls presigned URLs lack, without writing code. Under the hood it still uses presigned URLs: Nubbo checks the link’s rules first and only then issues a short-lived URL, so single files travel straight from your bucket to the recipient’s browser.

Step 1: Connect your bucket

Sign up for free, verify your email, then open Buckets and press Connect bucket. The wizard asks for your provider (Amazon S3, Cloudflare R2, DigitalOcean Spaces, Wasabi, Backblaze B2 or a custom S3-compatible endpoint), how to connect (an automatic setup with a full-access key, or a key limited to one bucket), your key and your bucket. It checks the key and the bucket, and finishes by testing CORS with a real upload from your browser. The bucket stays private and your keys are stored encrypted with AES-256-GCM. The Free plan includes 2 connections.

Step 2: Choose the file or folder

Find the item in the explorer and choose Share. You can also go to the Shared page, press New link and pick the bucket and the file or folder there.

Step 3: Set the protection

All three controls are optional and available on every plan:

Step 4: Create and send the link

Press Create link, copy it and send it by email, chat or whatever you use. The recipient opens a clean download page and does not need an account. A folder link lets them browse the folder, download single files or take everything as a ZIP, which their browser builds by downloading each file straight from your bucket.

Step 5: Send the password separately

Sending the password in the same message as the link defeats the point. If the link has a password, Send password by email delivers it as a one-time reveal link: the password is shown once, the reveal link expires after 24 hours, 3 days or 7 days, and you can add a short note. You are notified when it is opened.

Step 6: Track and revoke

The Shared page lists every link with its status and download count. You can edit the password, expiry or limit, deactivate a link (it stops issuing new download URLs right away) and reopen it later with the same address.

Sharing with specific people instead of a link

A link works for anyone who has it. When you want only named people to get in, Nubbo’s Share with people (on the Personal and Pro plans) sends a file or folder to specific email addresses with view or download permission, an optional expiry and a download cap, and logs each access. The recipients need a Nubbo account and find the item under Shared with me. Personal allows 10 people per item and 50 active shares; Pro allows 50 and 500.

Paid plans also offer encrypted links: the browser makes a sealed copy of the file and the key travels only in the link itself, so Nubbo cannot read it.

Which option should you use?

• One file, once, and you have the AWS CLI configured: a presigned URL is the fastest path.
• An application that already logs users in and serves lots of content: CloudFront signed URLs or cookies.
• Recurring sharing with people outside your team, whole folders or anything that needs a password or a limit: a share link saves time and mistakes.

Beyond a single link

Two related features cover the other common cases. File requests give you a public upload link so people can send files into your bucket without seeing anything else in it. Galleries turn a folder of photos or videos into a browsable page with layouts, a watermark and its own password. On the Free plan you get 3 of each and unlimited share links; Personal and Pro remove those caps. One honest note: thumbnails are generated on Nubbo’s server and stored in your own bucket under .nubbo-thumbs/.