Cloud Object Storage

AWS S3 (Recommended Default)

Setup (SDK v3)

import { S3Client, PutObjectCommand, GetObjectCommand } from '@aws-sdk/client-s3'; import { getSignedUrl } from '@aws-sdk/s3-request-presigner';

const s3 = new S3Client({ region: process.env.AWS_REGION });

Upload

// Direct upload await s3.send(new PutObjectCommand({ Bucket: process.env.S3_BUCKET, Key: uploads/${userId}/${filename}, Body: buffer, ContentType: mimeType, Metadata: { 'uploaded-by': userId }, }));

// Presigned URL (client uploads directly to S3) const url = await getSignedUrl(s3, new PutObjectCommand({ Bucket: process.env.S3_BUCKET, Key: uploads/${key}, ContentType: mimeType, }), { expiresIn: 3600 });

Presigned Download

const url = await getSignedUrl(s3, new GetObjectCommand({ Bucket: process.env.S3_BUCKET, Key: fileKey, }), { expiresIn: 3600 });

Multipart Upload (large files)

import { CreateMultipartUploadCommand, UploadPartCommand, CompleteMultipartUploadCommand } from '@aws-sdk/client-s3'; import { Upload } from '@aws-sdk/lib-storage';

// Simplified with lib-storage const upload = new Upload({ client: s3, params: { Bucket: bucket, Key: key, Body: readableStream }, partSize: 10 * 1024 * 1024, // 10MB parts leavePartsOnError: false, }); upload.on('httpUploadProgress', (progress) => console.log(progress)); await upload.done();

Python (boto3)

import boto3 from botocore.config import Config

s3 = boto3.client('s3', config=Config(signature_version='s3v4'))

Upload

s3.upload_fileobj(file_obj, bucket, key, ExtraArgs={'ContentType': mime_type})

Presigned URL

url = s3.generate_presigned_url('put_object', Params={'Bucket': bucket, 'Key': key, 'ContentType': mime_type}, ExpiresIn=3600)

Java (Spring)

@Service public class S3Service { private final S3Client s3;

public String generatePresignedUploadUrl(String key, String contentType) {
    var presigner = S3Presigner.builder().region(Region.of(region)).build();
    var request = PutObjectPresignRequest.builder()
        .signatureDuration(Duration.ofHours(1))
        .putObjectRequest(b -> b.bucket(bucket).key(key).contentType(contentType))
        .build();
    return presigner.presignPutObject(request).url().toString();
}

}

Bucket Policy Patterns

Public read for assets

{ "Statement": [{ "Effect": "Allow", "Principal": "", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::my-bucket/public/" }] }

CORS for direct uploads

{ "CORSRules": [{ "AllowedHeaders": ["*"], "AllowedMethods": ["PUT", "POST"], "AllowedOrigins": ["https://myapp.com"], "ExposeHeaders": ["ETag"], "MaxAgeSeconds": 3600 }] }

Anti-Patterns

Anti-Pattern Fix

Proxying large files through server Use presigned URLs for direct client upload/download

No Content-Type on upload Always set ContentType to enable correct browser behavior

Predictable file keys Use UUIDs or hashed paths to prevent enumeration

No lifecycle rules Set expiration for temp uploads, transition old files to Glacier

Long-lived presigned URLs Keep expiry short (1h for uploads, 15m for downloads)

No multipart for large files Use multipart upload for files > 100MB

Quick Troubleshooting

Issue Cause Fix

403 on presigned URL Expired, wrong region, or CORS Check expiry, region, CORS config

SignatureDoesNotMatch ContentType mismatch Ensure client sends same ContentType used in signing

Slow uploads Single-part for large files Use multipart upload with parallel parts

CORS errors Missing CORS configuration Add CORSRules to bucket

AccessDenied on public files Missing bucket policy Add public read policy for the prefix

Production Checklist

• Presigned URLs for all client uploads (never proxy large files)

• ContentType set on every upload

• UUID-based keys (prevent enumeration)

• CORS configured for direct uploads

• Lifecycle rules for temp/old files

• Encryption at rest enabled (SSE-S3 or SSE-KMS)

• Access logging enabled

• Versioning enabled for critical buckets

• CloudFront CDN for public assets