Presigned URLs and SAS Tokens

Try it out loud first. Then check yourself:

1. They are links that carry their own permission: anyone holding the link can use it, no login needed, until it expires.
2. Keep them narrow: one object, one action, short expiry; an Azure account SAS can cover a whole storage account.
3. Revoking is awkward: you often have to rotate the signing key, which breaks every other link signed with it too.
4. They leak through logs, chat, browser history and code; prefer short-lived links issued on demand, and log their use.

If the interviewer pushes back

• A partner needs to upload files to you weekly. How would you design that with presigned URLs?

Go deeper

• docs.aws.amazon.com/AmazonS3/latest/userguide/using-presigned-url.html
• learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview