Get an address or access link

In Addresses, you can copy the object’s S3 identifier or web URL, or create a presigned URL that temporarily authorizes reading it. Copying an address does not make the object public.

Choose the target#

1. For a specific version, turn on Show versions in the S3 pane.
2. Select the current object or the version you want, then open Properties.
3. Open Addresses after loading.

S3 URI: shows s3://bucket/key. Its copy button preserves the key but not the version. Web URL: accounts for the endpoint and the versionId parameter of a specific version. Delete markers have no usable download link.

With Options cleared, the URL is ordinary, with no added authentication. Access depends on public permissions or authentication provided by the client. Copy URL to Clipboard and Copy URLs to Clipboard in the context menu also copy ordinary URLs, not presigned URLs.

Prepare a presigned URL#

The account needs usable credentials and permission to read the target, normally s3:GetObject or s3:GetObjectVersion. Open File > Accounts…, select the account, click Edit…, then open Capabilities > General. Presigned URLs must match the service’s support. The capability does not grant read access.

Encryption permissions still apply, including permissions for the KMS key. A presigned URL does not restore an archive: the content must be readable when the URL is used. See encryption and archives.

Anyone with the URL can use the signer’s authorization while it is valid. Service policies, credential expiration or revocation may invalidate it sooner.

1. In Properties > Addresses, select Options.
2. Choose Signed.
3. Enter an expiration in the displayed time zone, (UTC) or (local time). The initial expiration is one hour from now.
4. Wait for credentials and the Web URL: display.
5. Click Copy web URL to copy the encoded link, or Open to open it in your default browser.

Expiration must be in the future. Signature Version 4 limits validity to seven days. If temporary credential expiration is known, the URL cannot outlast it. S3Client cannot generate a Signature Version 2 URL with temporary credentials.

In version view, the URL preserves the target version. A current-object URL follows the key; replacing the object can change the returned content. S3Client creates the URL without asking the service to read the object. To check access, try the URL in the browser or software that will use it.

SSE-C links#

SSE-C requires HTTPS, Signature Version 4, reading permitted by the encryption policy and the object’s exact key. Supply it through Encryption > Read key…, then Reload properties, before returning to Addresses.

The URL must be Signed and accompanied by SSE-C headers. Open is disabled because a browser does not send them from the link alone.

• Copy required SSE-C headers (includes key) copies the algorithm, encoded key and its MD5.
• Copy command including SSE-C key copies a curl.exe command on Windows, or curl elsewhere, containing the link and headers.

On Windows, run the copied command in PowerShell.

These buttons place the secret key on the clipboard; the command may remain in terminal history. Share these values only with recipients authorized to possess the key. The temporary key is not saved in the account.

Torrent#

Torrent appears if BitTorrent download metadata is enabled, no specific version is targeted and the object’s known size is below the 5 GiB single-copy limit. Select Options, then Torrent, to obtain the BitTorrent metadata address. This choice does not sign the request or grant access. It depends on actual support for this older API.

Unavailable or rejected links#

An expired URL cannot be extended; generate a new one. See credentials and troubleshooting.