presigned URL
A link signed with your credentials that grants access to one stored object and expires after a short time.
Two habits matter most. Keep buckets private, and when someone outside needs one file, hand them a presigned URL: a link signed by your credentials that works for one object and expires, say, in fifteen minutes. And add lifecycle rules that move old data to colder, cheaper storage or delete it after a set time, so last year's logs don't quietly cost you every month.
Try it now
Match the shape of the work to the way it runs: always on, packaged and scaled, or only when called.
Learn it properly
Cloud for AI engineers · Access policies and least privilege, storage, compute choices, managed model endpoints, secrets and budgets. About 30 minutes.
Other terms from the same lesson
- egress: Data leaving a cloud provider's network, usually to the internet, which providers charge for by the gigabyte.
- IAM: A cloud's system of identities and policies that decides who may do what to which resource.
- least privilege: Giving each person or service only the actions, on only the resources, its job needs, so a mistake or a leak can do little harm.
- service account: An identity a program uses to call cloud services, with its own narrow permissions, instead of a person's login.
- workload identity: Short-lived credentials a cloud gives a running service automatically, so there's no long-lived key to store or leak.
Never trained an AI?
Teach a small one to write, right in your browser. It takes about 20 seconds and needs no account.