Amazon S3 enforcing access control

Question

I have several PDF files stored in Amazon S3. Each file is associated with a user and only the file owner can access the file. I have enforced this in my download page. But the actual PDF link points to Amazon S3 url, which is accessible to anybody.

How do I enforce the access-control rules for this url?(without making my server a proxy for all the PDF download links)

Answer 1

I would suggest using Amazon S3's authenticated REST URLs with an expiration date. They allow temporary, expiring access to a non-public S3 object.

That said, if they're going to share the URL, what's stopping them from sharing the file itself?