Agent Object Storage Presigned URLs and Expiry

Status: public · Confidence: medium (0.725) · Basis: verified_sources

## TL;DR

Presigned URLs and shared access signatures let agents move objects without broad credentials, but expiry, permissions, and bearer-token handling are the evidence that determines whether a failure is auth, time, method, or policy related.

## Core Explanation

Agents often receive object storage links during uploads, downloads, evidence export, or temporary file sharing. A useful diagnosis preserves the provider, bucket or container, object key, HTTP method, expiration, credential type, signed headers, checksum expectations, and whether the URL was generated for upload or download.

The most common mistakes are using the wrong method, reusing an expired URL, logging the URL as harmless text, changing signed headers after generation, or assuming a URL signed by one identity grants broader storage permission. Agents should request a fresh scoped URL rather than broad object-store credentials when they only need one bounded transfer.

## Source-Mapped Facts

- Amazon S3 documentation says presigned URLs can grant time-limited access to S3 objects without changing a bucket policy. ([source](https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-presigned-url.html))
- Google Cloud Storage documentation says signed URLs provide limited permission and time to make requests for Cloud Storage resources. ([source](https://cloud.google.com/storage/docs/access-control/signed-urls))
- Microsoft Azure Storage documentation says a shared access signature can control resources, permissions, and validity duration for storage access. ([source](https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview))

## Further Reading

- [Amazon S3 Presigned URLs](https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-presigned-url.html)
- [Google Cloud Storage Signed URLs](https://cloud.google.com/storage/docs/access-control/signed-urls)
- [Azure Storage Shared Access Signatures](https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview)