AWS S3 · API Gateway · Lambda

Secure Document Intake Using Presigned S3 URL

This static frontend is wired to a live API that requests a presigned S3 upload URL from Lambda, then uploads the selected file directly from the browser to a private S3 bucket with short-lived access.

Try the demo flow View file structure

Delivery model Simple front end, secure AWS workflow The experience is presented as a clean static site, while the secure upload flow is handled by AWS services behind the scenes.

Security approach Private storage with time-limited access Files are uploaded through temporary access links, so sensitive data does not rely on long-lived credentials or exposed buckets.

What this shows Practical design decisions in action A visitor can quickly see how the architecture works and why the chosen AWS pattern is appropriate for secure file handling.

Security controls

Access

Temporary upload authorization

The browser requests a short-lived presigned URL from API Gateway and Lambda, then uploads directly to S3 without broad account access.

Protection

Encryption and restricted storage

Objects land in a private S3 bucket with server-side encryption, controlled prefixes, and a clear separation between public UI and private data handling.

Traceability

Audit and post-upload actions

The returned object key can feed later workflows such as validation, metadata recording, tagging, malware scanning, or review routing.

Live demo surface

This form calls your live API endpoint, receives a presigned S3 upload URL, and uploads the selected file directly from the browser. The API endpoint is /Demo/create-presigned-s3-url.

User flow

The frontend stays static. Sensitive authorization is delegated to short-lived backend logic.

Load site

CloudFront or another static host serves the HTML, CSS, and JavaScript.

Request upload URL

The browser sends only metadata to API Gateway, not the file itself.

Generate presigned access

Lambda validates the request and returns an S3 upload URL with a limited lifetime.

Direct upload to S3

The selected file goes from browser to S3, avoiding unnecessary backend file handling.

Post-upload handling

The object key can later trigger tagging, persistence, review logic, or scanning.

Architecture

User browserStatic UI, form logic, direct upload

→

API GatewayPublic endpoint, request routing

→

LambdaValidation and presigned URL generation

Browser direct uploadPUT request with short-lived signature

→

Private S3 upload bucketEncrypted storage, controlled object key

→

Optional processingEvents, scan, metadata, review