Implement single-exchange tokens for short-lived Amazon S3 presigned URLs with Terraform

This article explains how to implement a serverless application that generates single-use tokens for secure, short-lived S3 presigned URL access using Terraform.

• Single-use tokens prevent presigned URL reuse, reducing security risks from shared URLs
• Tokens exchanged exactly once for very-short-duration presigned URLs via API Gateway
• Lambda generates secure tokens stored in DynamoDB with configurable TTL expiration
• AWS WAF protects API with rate limiting and managed rule sets
• DynamoDB conditional writes prevent race conditions on token reuse attempts
• Solution deployable with Terraform from provided GitHub repository
• Testing demonstrated via AWS CloudShell with example commands provided
• Best practices include custom domains, VPC integration, Cognito authorization, and observability tools

This solution enables long-lived access tokens that outlive S3's 7-day presigned URL maximum while minimizing public exposure of actual presigned URLs.