S3 presigned URL security review cost, $2,400 once

A link that expires is not the same thing as a private file.

S3 presigned URL security review cost is $2,400 once for one web app that hands out an Amazon S3 upload or download link. $1,200 starts the work. I write the report 48 hours after access works. You own the PDF. There is no subscription.

Short answer: S3 presigned URL security review cost is $2,400 once, with $1,200 to start, inside the web application security review. I check who can mint a time-limited S3 link, how long it lives, and whether the wrong person can still open the file. You own the report. A Firebase Storage rules pass and a compliance letter are different products.

What is the S3 presigned URL security review cost?#

The S3 presigned URL security review cost is $2,400 once for one application. $1,200 starts it and the balance is due when the report is delivered. You own the PDF. There is no monthly fee. A second app, a source-code audit, or a certification letter is a different quote.

At 24 months and at 36 months the cash number is still $2,400. No seat fee. Same figure on security review pricing.

Amazon’s sharing guide says objects are private by default. A presigned URL is time-limited access from the credentials that signed it. The review asks whether your app still behaves that way after it prints the link.

What you are buying	Price	What you actually get
This review, one web app	$2,400 once, $1,200 to start	Frontend, auth, and the API that mints S3 links. Written 48 hours after access. One retest of the same URL.
A second app	Another $2,400	Same scope, a new written authorization
Source-code audit or a certification letter	Not this quote	Separate work. I do not invent certifications.
Workflow Automation	$3,500 once	One named ops job, such as filing those PDFs into QuickBooks. Not a security review.
AI Front Door	$3,500, $7,500, or $14,000 once	Customers book or pay from ChatGPT, Claude, Grok, or another MCP-capable app. Not a file-link review.

What does the review check on the link?#

I sign in as the roles you already sell and record which files those sessions can open or replace. The pass covers the live screens, the login, and the route that mints the link. The PDF names severity, path, and role. It does not include a working upload recipe.

I look for six things:

• Who signs the URL, and whether a long-lived access key sits in the browser.
• The lifetime you intended versus the credential that actually signed it.
• The object key: one customer’s prefix, or a shared folder.
• Download versus upload. Opening someone else’s invoice is a different finding from writing a key you did not assign.
• The POST policy. AWS documents a content-length-range condition. Their example allows 1 to 10 MiB. I check whether size and content type are pinned.
• A bucket policy or ACL that makes the object readable with no signature.

If the files live in Cloud Storage for Firebase, that is a Firebase security rules review. This post is the S3 link your server prints.

How should a file move from the app into S3?#

The server should mint a short-lived link for one object key after the user is signed in. S3 stores the bytes. Your database stores which customer owns that key. A person steps in when the key, type, or size does not match the row.

Step	Action	System of record	Human escalation
Trigger	A signed-in user attaches a photo, PDF, or job file	Your app session	No session, no link
Mint	Server signs a GET, PUT, or POST for one key	The credentials that sign, kept off the browser	Signing fails, or the key is outside that customer’s prefix
Store	Customer uploads or downloads through that URL	The S3 object	Size or content type outside the policy you set
Record	Save the key on the job, invoice, or client row	Your database	The object exists and the row does not, or the reverse
Expire	The URL dies on the clock you chose	S3 rejects the signature	Staff still need the file after expiry: mint a new link, do not make the object public

The AWS CLI presign command defaults to 3,600 seconds if you omit --expires-in. Name the lifetime you meant before I start. Filing the PDF into QuickBooks is Workflow Automation, $3,500 once, live in 7 to 10 days. That job does not check who can open the file.

How long should that link stay valid?#

Signature Version 4 allows at most 604,800 seconds, seven days, and only when a long-lived IAM user signs the URL. Temporary credentials die with the session. Revoke the key and the link dies too, even if the query string still says seven days.

AWS documents the cap this way. An IAM user with Signature Version 4 can sign for up to seven days. X-Amz-Expires accepts 1 through 604,800 seconds. Temporary credentials cannot outlive the session. An EC2 instance role is typically six hours, so a Lambda role that “signs for a week” dies with the session. The S3 console allows 1 minute to 12 hours. The CLI and the SDKs can go to seven days. Delete or deactivate the access key and the URL stops.

A year-long customer download is a different mechanism. AWS points that case at CloudFront signed URLs. Building that distribution is not inside $2,400. If the app pretends a role session can sign for a year, I write that down and stop.

What is not included for $2,400?#

You get one authorized app: severity, the path, the role, and a fix an engineer can ticket. I do not ship exploit steps, a second production app, a bucket rebuild, or a certificate I do not hold. The PDF is yours. There is no monthly fee on this price.

The document shape is the sample pentest report. No client names. A network test and a full source audit are separate quotes. Moving signing off the browser is your engineer’s job after the finding.

When this isn’t the right move yet#

Skip the review when there is no URL I am allowed to use, when a contract names a certification I do not hold, or when the real job is an ops workflow or a booking flow. A template bucket policy is not this product.

Do not buy it yet if you cannot authorize a test on a URL you own. The 48-hour clock starts when access works. Do not buy it for a CREST or SOC letter. I will not invent one. Do not buy it to have me rebuild the upload pipeline. The report says what to change.

Firebase Storage rules are the other review, same $2,400. Invoice filing is Workflow Automation at $3,500. Customers booking from ChatGPT, Claude, or Grok is AI Front Door, from $3,500, and it does not check who can open an S3 object.

If the skip list does not match your app, start the review at $1,200. I need the URL, a customer login, and written authorization. The report follows 48 hours after access works.

If you would rather talk through the file flow first, book a 20-minute call. We use it to see whether this review fits. It does not replace the start form.