We have a lambda created by SST that's generating signedUrls for GetObject from S3 and the expiry seems to be the 6 hour maximum for an IAM Instance Profile. I think I'm not understanding the terminology here:

The credentials that you can use to create a presigned URL include:

IAM instance profile: Valid up to 6 hours

AWS Security Token Service : Valid up to 36 hours when signed with permanent credentials, such as the credentials of the AWS account root user or an IAM user

IAM user: Valid up to 7 days when using AWS Signature Version 4

To create a presigned URL that's valid for up to 7 days, first designate IAM user credentials (the access key and secret access key) to the SDK that you're using. Then, generate a presigned URL using AWS Signature Version 4.

Does anyone have idea how I go about using the 2nd option (AWS Security Token Service) to make it available for 36 hours?

Yeah I had this issue also

Thanks - when you say, create IAM credentials to us to generate the URL, what does that look like? I can provide an access key and secret key to the signer but it sounds like what you did is more secure

Let me check in a bit what exactly I did, I don't think it was particularly good

no problem, thanks