====== Pre-signed URL ======

**What it is:** A URL that grants temporary permission to access an S3 object.

**What it’s for:**
  * Let users upload/download to S3 without making the bucket public.
  * Share access that expires automatically.

**Key ideas:**
  * Created by an authorized principal (with S3 permissions).
  * Has an expiration time.
  * Useful for secure uploads from browsers/mobile.

**Exam cues:**
  * “grant temporary download access” → pre-signed URL.
  * “upload directly to S3 from client securely” → pre-signed URL (often with POST policy).

**Hard words:**
  * *temporary* /ˈtɛmpəˌrɛri/: tạm thời
  * *expiration* /ˌekspəˈreɪʃn/: thời hạn
  * *grant* /ɡrænt/: cấp (quyền)