How to Generate an AWS S3 Presigned Upload URL (boto3)

What a presigned upload URL is

Your backend signs a temporary URL that grants permission to PUT one object to S3. The client uploads directly to S3 - your server never proxies the bytes, and your AWS credentials never leave the backend. Perfect for mobile/web file uploads.

The correct boto3 code

import boto3
s3 = boto3.client("s3")

def presign_upload(bucket: str, key: str) -> str:
    return s3.generate_presigned_url(
        ClientMethod="put_object",      # WRITE - not get_object
        Params={"Bucket": bucket, "Key": key},
        ExpiresIn=3600,                 # seconds the URL is valid
    )

The client then uploads with a plain HTTP PUT:

curl -X PUT --upload-file photo.jpg "<presigned-url>"

The two bugs that cause a 403 on upload

1. ClientMethod="get_object" - signs a URL for reading, so a PUT is denied. Uploads need put_object.
2. ExpiresIn=0 (or too small) - the URL is expired the instant it's issued, so every upload 403s. Set a realistic window (e.g. 3600s).

Both produce the same symptom (403 on PUT), so check the method and the expiry first.

Things that bite people

• Sign exactly what the client sends. If the upload sets Content-Type, include it in Params (and the client must send the same header) or the signature won't match.
• The backend's IAM role needs s3:PutObject on the bucket/key - the presigned URL only delegates permission the signer already has.
• Key per upload - generate a unique object key (e.g. uploads/<uuid>.jpg) so clients can't overwrite each other.