AWS S3 · API Gateway · Lambda

Secure Document Intake Using Presigned S3 URL

This static frontend is wired to a live API that requests a presigned S3 upload URL from Lambda, then uploads the selected file directly from the browser to a private S3 bucket with short-lived access.

Try the demo flow View file structure

Delivery model Simple front end, secure AWS workflow The experience is presented as a clean static site, while the secure upload flow is handled by AWS services behind the scenes.

Security approach Private storage with time-limited access Files are uploaded through temporary access links, so sensitive data does not rely on long-lived credentials or exposed buckets.

What this shows Practical design decisions in action A visitor can quickly see how the architecture works and why the chosen AWS pattern is appropriate for secure file handling.

Problem

Browsers should not have broad, long-lived access to private storage.

Upload flows need a way to let users send files without exposing bucket credentials or opening the door to unrestricted storage access.

Solution

This demo simulates a short-lived upload authorization flow.

It shows how a browser can request a presigned upload URL, send the file directly to S3, and keep access tightly scoped and temporary.

Why it matters

Browsers should not have broad, long-lived access to private storage.

Frequency Misconfigured storage access is a common cloud risk.

OWASP and cloud security guidance consistently treat exposed storage and weak authorization as recurring API and cloud failures.

Severity Overbroad upload access can expose sensitive files.

This demo shows why uploads should use short-lived authorization, private buckets, and controlled prefixes instead of broad credentials.

Business impact Storage exposure can lead to breach response, cleanup, and trust loss.

Imperva estimated global annual losses from API insecurity at $41B to $75B, highlighting the cost of weak access controls in connected systems.

Sources: Imperva / Marsh McLennan, OWASP API Security Top 10

Security controls

Access

Temporary upload authorization

The browser requests a short-lived presigned URL from API Gateway and Lambda, then uploads directly to S3 without broad account access.

Protection

Encryption and restricted storage

Objects land in a private S3 bucket with server-side encryption, controlled prefixes, and a clear separation between public UI and private data handling.

Traceability

Audit and post-upload actions

The returned object key can feed later workflows such as validation, metadata recording, tagging, malware scanning, or review routing.

Live demo surface

This form calls your live API endpoint, receives a presigned S3 upload URL, and uploads the selected file directly from the browser. The API endpoint is /Demo/create-presigned-s3-url.

User flow

The frontend stays static. Sensitive authorization is delegated to short-lived backend logic.

Load site

CloudFront or another static host serves the HTML, CSS, and JavaScript.

Request upload URL

The browser sends only metadata to API Gateway, not the file itself.

Generate presigned access

Lambda validates the request and returns an S3 upload URL with a limited lifetime.

Direct upload to S3

The selected file goes from browser to S3, avoiding unnecessary backend file handling.

Post-upload handling

The object key can later trigger tagging, persistence, review logic, or scanning.

Architecture

User browserStatic UI, form logic, direct upload

→

API GatewayPublic endpoint, request routing

→

LambdaValidation and presigned URL generation

Browser direct uploadPUT request with short-lived signature

→

Private S3 upload bucketEncrypted storage, controlled object key

→

Optional processingEvents, scan, metadata, review

Secure Document Intake Using Presigned S3 URL

Problem and solution

Browsers should not have broad, long-lived access to private storage.

This demo simulates a short-lived upload authorization flow.

Browsers should not have broad, long-lived access to private storage.

Security controls

Temporary upload authorization

Encryption and restricted storage

Audit and post-upload actions

Live demo surface

Architecture