Getting preSignedUrl from s3 even if wrong access key or secret key is entered

I am generating a preSignedUrl and then uploading the file through that url.
The issue is that even if I enter the wrong access key or secret key I get the preSignedUrl, though if I try to upload using that url I get 400 error.

  <?xml version="1.0" encoding="UTF-8"?>
    <Error>
        <Code>AuthorizationQueryParametersError</Code>
        <Message>Query-string authentication version 4 requires the X-Amz-Algorithm, X-Amz-Credential, X-Amz-Signature, X-Amz-Date, X-Amz-SignedHeaders, and X-Amz-Expires parameters.</Message>
        <RequestId>{requestId}</RequestId>
        <HostId>{hostId}</HostId>
    </Error>

Is there some way I get the error while generating the preSignedUrl so that I don't have to try and upload the file.

    AmazonS3 s3Client = AmazonS3ClientBuilder.standard()
                    .withCredentials(new AWSStaticCredentialsProvider(new BasicAWSCredentials("accessKey", "secretKey")))
                    .withRegion(clientRegion)
                    .build();
    
    GeneratePresignedUrlRequest generatePresignedUrlRequest = new GeneratePresignedUrlRequest(bucketName, objectKey)
     .withMethod(HttpMethod.PUT)
     .withExpiration(expiration);

    URL url = s3Client.generatePresignedUrl(generatePresignedUrlRequest);

Generating a pre-signed URL doesn't require an API call; it can be generated by the framework using the specified access key and secret.

The generated URL will be validated by S3 when the request is received, and will obviously only be accepted when valid credentials were used for generating it.

Bottom line: in order to validate your credentials you need to make an API request that actually performs a call to AWS. This can be pretty much any other method on your s3Client.

Let's start with this:

.withCredentials(new AWSStaticCredentialsProvider(new BasicAWSCredentials("accessKey", "secretKey")))

Static credentials go against AWS best practice. Instead, rely on credentials provided via environment variables or an execution role (when running on EC2, ECS, or Lambda).

The only way that you can verify that the credentials are valid is to try them. You could write a small dummy file, however this may cause problems for anything that is supposed to read that file, due to eventual consistency on S3.

There's also the problem that the expiration that you give the URL may not correspond to the lifetime of the credentials.

The best solution to all of these problems is to create a role that has access to PUT the files on S3, and has a duration consistent with your URL expiration (note that the maximum is 12 hours), then explicitly assume that role in order to construct the request:

final String assumedRoleArn = "arn:aws:iam::123456789012:role/Example";
final String sessionName = "example";
final String bucketName = "com-example-mybucket";
final String objectKey = "myfile.txt";

final int expirationSeconds = 12 * 3600;
final Date expiresAt = new Date(System.currentTimeMillis() + expirationSeconds * 1000);

AWSSecurityTokenService stsClient = AWSSecurityTokenServiceClientBuilder.defaultClient();

AWSCredentialsProvider credentialsProvider = new STSAssumeRoleSessionCredentialsProvider.Builder(assumedRoleArn, sessionName)
                                             .withStsClient(stsClient)
                                             .withRoleSessionDurationSeconds(expirationSeconds)
                                             .build();

AmazonS3 s3Client = AmazonS3ClientBuilder.standard().withCredentials(credentialsProvider).build();

URL presignedUrl = s3Client.generatePresignedUrl(bucketName, objectKey, expiresAt, HttpMethod.PUT);