Common presigned PUT pattern
Signs an operation, object location, expiration, and selected request details. It does not provide the POST policy's native minimum-and-maximum range condition.
Storage boundary · Direct browser upload
Put the limit in the signed contract.
The question was not whether a browser could upload directly to S3. It was where the size range, key, content type, and lifetime would be enforced when the browser could not be trusted.
The distinction
PUT and POST sign different shapes.
Presigned POST policy
Returns a destination and signed form fields. S3 evaluates exact-match, prefix, and content-length-range conditions.
This is not “PUT bad, POST good.” It is a placement decision for a specific requirement.
The contract
Server authority chooses the boundaries.
Authorized tenant
Opaque exact key
Exact content type
Allowed size range
Defense in depth
Browser explains. Storage rejects. Pipeline verifies.
Client-side UX check
Signed policy condition
S3 enforcement
Post-upload validation
A permitted-size upload can still be hostile. POST policy does not replace malware scanning, document validation, authorization, encryption, retention, or audit logging.
Primary references
Amazon S3 POST policy conditions · AWS guidance for presigned URLs
Watch
Put the Limit in the Signed Contract
How CareFlow moved upload-size enforcement from client convention into an S3-evaluated POST policy—and tested the policy itself.