"S3 预签名直传与权限控制实践"

S3 预签名直传与权限控制实践生成预签名 URL（Node.js）import { S3Client, PutObjectCommand } from '@aws-sdk/client-s3'; import { getSignedUrl } from '@aws-sdk/s3-request-presigner'; const s3 = new S3Client({ region: 'us-east-1' }); const command = new PutObjectCommand({ Bucket: 'uploads', Key: 'file.bin', ContentType: 'application/octet-stream' }); const url = await getSignedUrl(s3, command, { expiresIn: 900 }); 客户端上传curl -X PUT -H "Content-Type: application/octet-stream" --data-binary @file.bin "$URL" 权限与安全使用最小权限 IAM，允许 `s3:PutObject` 针对指定桶与前缀设置合理的过期时间与内容类型校验总结预签名直传降低服务端带宽压力，配合严格权限与过期控制，兼顾性能与安全。