{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-14T20:21:57.226Z",
  "record_id": "VXI-EXT-PROCUREMENT-S3-PRESIGN-LIFETIME-01-v1",
  "record_kind": "external_reference",
  "title": "S3 presigned URLs: Reuse and credential-bound lifetime",
  "system": "Amazon S3",
  "evidence_family": "vendor_evidence_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Is an S3 presigned download a single-use link valid until its stated expiry?",
  "near_questions": [
    "Is a presigned download link single-use?",
    "Can an S3 URL stop working before its configured expiry?",
    "Can a download continue after a signed URL expires?",
    "What happens when a download restarts after expiry?",
    "Which credentials determine a signed link lifetime?",
    "Can a presigned upload replace an existing object?",
    "Does a signed URL specify an allowed HTTP method?",
    "What evidence proves a one-time download control?",
    "Can anyone holding the link reuse it?",
    "Which delivery assumptions should procurement record?",
    "When should a link-expiry assurance remain qualified?",
    "Can I save a signed-download boundary review?"
  ],
  "supported_claims": [
    {
      "claim": "The documentation allows repeated use before expiry. Temporary signing credentials can expire earlier than the URL setting, and a download begun before expiry can continue afterwards. Review reuse requirements and credential lifetime separately from the displayed expiration; the URL alone does not implement single-use delivery.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Verified buyer configuration or effective access rights",
    "Independent execution, completeness or security testing",
    "Vendor certification, legal compliance or guaranteed suitability"
  ],
  "public_summary": "The documentation allows repeated use before expiry. Temporary signing credentials can expire earlier than the URL setting, and a download begun before expiry can continue afterwards. Review reuse requirements and credential lifetime separately from the displayed expiration; the URL alone does not implement single-use delivery.",
  "related_record_ids": [
    "VXI-EXT-PROCUREMENT-AZURE-SAS-REVOCATION-01-v1",
    "VXI-EXT-PROCUREMENT-OKTA-SESSION-TOKEN-01-v1",
    "VXI-EXT-PROCUREMENT-CLOUDFLARE-SAAS-SESSION-01-v1"
  ],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "S3 presigned URL lifetime and reuse",
    "source_url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-presigned-url.html",
    "checked_on": "2026-10-14",
    "candidate_record_id": "VXI-EXT-PROCUREMENT-S3-PRESIGN-LIFETIME-01-v1",
    "candidate_record_sha256": "54145885430ed5dcc21f3759e284722d0ac9609c41e3f314f87d7c0baedaa8b0",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "The documentation allows repeated use before expiry. Temporary signing credentials can expire earlier than the URL setting, and a download begun before expiry can continue afterwards. Review reuse requirements and credential lifetime separately from the displayed expiration; the URL alone does not implement single-use delivery.",
    "required_buyer_context": "Signing credential lifetime, allowed method/object, reuse policy and request timing.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "decision_profile": {
    "schema": "varexis-vendor-evidence-review/1",
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-14",
    "claim_to_check": "The signed URL is single-use and its expiry is the complete access boundary.",
    "documented_statement": {
      "status": "documented",
      "statement": "The documentation allows repeated use before expiry. Temporary signing credentials can expire earlier than the URL setting, and a download begun before expiry can continue afterwards. Review reuse requirements and credential lifetime separately from the displayed expiration; the URL alone does not implement single-use delivery.",
      "source_ids": [
        "s3-presign"
      ]
    },
    "buyer_evidence_required": [
      "Signing identity type and credential expiration.",
      "Configured URL expiry, method and object binding.",
      "Any separate single-use enforcement and observed download behaviour."
    ],
    "review_condition": {
      "status": "varexis_review_policy",
      "statement": "Do not claim single-use access without an additional evidenced control."
    },
    "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature.",
    "evidence_sources": [
      {
        "source_id": "s3-presign",
        "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-presigned-url.html",
        "final_url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-presigned-url.html",
        "title": "S3 presigned URL lifetime and reuse",
        "checked_on": "2026-10-14",
        "sha256": "4e6f7c5f3d9c826b209fd4e7048c9982125cb75c18ff4d4ab7e470cd4235eecc",
        "bytes": 28325
      }
    ],
    "observed_deployment": false,
    "commercial_reliance_boundary": "Procurement evidence support only; no supplier clearance, legal conclusion, configuration audit or verification of the buyer's claim is supplied.",
    "paid_value": {
      "decision_context": "Preserve the delivery assumptions that a signed URL does and does not support.",
      "free": "Complete review, practical questions, sources and limitations; may be saved locally.",
      "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.",
      "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.",
      "excluded": [
        "Fresh vendor research",
        "Continuous monitoring or change alerts",
        "Testing the buyer configuration",
        "Private evidence or vendor certification"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "A saved purchase does not recheck the source or buyer configuration.",
      "specific_watch": "Credential lifetime, URL policy and any application-level use limit."
    }
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#s3-presigned-url-lifetime-reuse",
  "machine_readable_record": "/varexis-index/records/s3-presigned-url-lifetime-reuse.json"
}