📥 Download & Presigned URLs
Download
Standard GetObject, from any tool:
s3 s3 cp s3://my-bucket/report.pdf ./report.pdf
Range requests are supported (HTTP 206) — useful for resumable downloads and media streaming:
s3 s3api get-object --bucket my-bucket --key video.mp4 \
--range bytes=0-1048575 first-megabyte.bin
Object responses include:
| Header | Meaning |
|---|---|
ETag | MD5 of the content (or md5-of-md5s-N for multipart uploads) |
x-amz-meta-cid | The object's IPFS CID |
x-amz-meta-* | Any custom metadata set at upload |
Accept-Ranges: bytes | Range requests supported |
Presigned URLs
A presigned URL grants time-limited access to one object without sharing your credentials — the signature is embedded in the URL itself. Anyone with the link can download the file until it expires.
s3 s3 presign s3://my-bucket/report.pdf --expires-in 3600
https://s3.lighthouse.storage/my-bucket/report.pdf?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=...&X-Amz-Expires=3600&X-Amz-Signature=...
The URL works with plain curl, a browser, an <img> tag — no S3 client needed:
curl -o report.pdf "https://s3.lighthouse.storage/my-bucket/report.pdf?X-Amz-..."
SDK equivalents: generate_presigned_url in boto3, getSignedUrl in Node.js.
Presigned URLs stop working when they expire, or immediately (within ~30 s) if the signing keys are revoked. Tampering with any part of the URL — the key, the expiry — invalidates the signature.
For content you want permanently public, you don't need presigned URLs at all — grab the object's CID from x-amz-meta-cid and share it through any IPFS gateway.