Refreshing Expired Signed Object Storage Access for Generated SaaS Training Images
Short answer: keep generated training images private, store object keys rather than signed links, and have the SaaS API issue a fresh presigned download URL when a preview or download encounters an expired one. Don't turn the bucket public. That doesn't fix the ownership problem, and it isn't an available escape hatch in the evaluated API: public and public-read ACLs are unavailable, so…
The report suggests that for a SaaS app storing generated training images, it's crucial to keep these images private and store object keys instead of signed links. The SaaS API should issue a fresh presigned download URL when an expired one is encountered. It's advised not to turn the bucket public as public and public-read ACLs are unavailable, resulting in a null public_url.
The report emphasizes that the link is not the artifact, and the distinction between the two drives storage costs, recovery plans, and large-file tests. It recommends starting with byte-days, requests, and transfer charges to understand the workload better. The report also proposes using a private object with a stable database record containing its bucket and key, and a short-lived URL treated as disposable delivery state.
It advises keeping one canonical artifact for the reproducibility window, deleting derived previews when their window ends, and retaining the metadata needed to explain that deletion.
Brief written by urgent.news from Dev.to's own syndicated text. Machine-written — may contain errors; check the original before relying on it.
