What it is: A URL that grants temporary permission to access an S3 object.

What it’s for:

• Let users upload/download to S3 without making the bucket public.
• Share access that expires automatically.

Key ideas:

• Created by an authorized principal (with S3 permissions).
• Has an expiration time.
• Useful for secure uploads from browsers/mobile.

Exam cues:

• “grant temporary download access” → pre-signed URL.
• “upload directly to S3 from client securely” → pre-signed URL (often with POST policy).

Hard words:

• *temporary* /ˈtɛmpəˌrɛri/: tạm thời
• *expiration* /ˌekspəˈreɪʃn/: thời hạn
• *grant* /ɡrænt/: cấp (quyền)