1. We have a community site.
2. There we have a page.
3. In that page, we have a link.
4. On click of that link a file opens up. the requirement is that only 'logged in user' should be able to open and see the file.
5. Nobody else should able to see it.
More info using scenerio:- File should only opened with the help of click within the community site. After opening the file. If somebody copy the URL from address bar and then pasted in the 'incognito mode' then file should not be opened.
Current progress:-
I researched about and got solution related to pre-signed Url but i think it's the solution with help of code. I searching for any workaround using configuration within the AWS account.
Any help would be appreciated.
#Trailhead #Experience Cloud #Experience Site #AWS S3 #AWS #Lightning Aura Components #Salesforce Developer #Salesforce Admin
Hi Kushagra,
Yes, creating an IAM user is the correct path, and it's confirmed by AWS's own official documentation, not just common practice. AWS explicitly recommends creating an IAM user with least-privilege permissions first, then generating access keys under that IAM user, never using your AWS root account credentials for this.
Steps to get your Access Key and Secret Key (official AWS process):
1. Log into the AWS Console with your root/admin account (only for this setup step, not for ongoing use).
2. Go to IAM > Users > click "Create user".
3. Give it a descriptive name, e.g. salesforce-s3-integration.
4. Do NOT enable AWS Management Console access, this user only needs programmatic access, not console login.
5. Attach a permission policy scoped only to what's needed, ideally a custom policy limited to s3:GetObject on your specific bucket/prefix, not full S3 access. This follows AWS's least-privilege guidance.
6. After the user is created, go to that user > Security credentials tab > Access keys section > "Create access key".
7. Select the use case (choose "Application running outside AWS" or similar, matching your Apex callout scenario).
8. AWS shows you the Access Key ID and Secret Access Key ONCE. Download the CSV or copy both immediately, the Secret Access Key cannot be retrieved again after this screen, you'd have to delete and recreate the key if lost.
Official reference:
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.htmlImportant note on "is this the only way": Technically no, AWS's own best-practice guidance actually recommends AGAINST long-term access keys where avoidable, and prefers IAM Roles with temporary/short-term credentials (via AWS STS) since those auto-expire and reduce risk if leaked.
Official reference:
https://docs.aws.amazon.com/IAM/latest/UserGuide/security-creds-programmatic-access.htmlHowever, for a Salesforce Apex integration specifically, since Apex runs outside AWS and can't assume an IAM role directly the way an EC2/Lambda service can, using a scoped-down IAM user with long-term access keys (stored securely in Named Credential/Protected Custom Metadata, as I mentioned earlier) is the practical and accepted approach here. Just make sure to:
- Scope the policy to only that one bucket/prefix
- Rotate the access key periodically
- Never commit it to code, always pull from Named Credential/Custom Metadata at runtime
So to directly answer: yes, IAM user + access key is the right and standard way for your use case.
