AWS S3 Storage (C#)

Generate pre-signed AWS S3 URLs for C# uploads and downloads.

1|Updated May 2, 2026
One-click install
npx skills add https://github.com/Levironexe/architect --skill aws-s3-storage-c
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: AWS S3 Storage (C#)
Source: https://github.com/Levironexe/architect/tree/main/skills/patterns/s3-csharp
Command: npx skills add https://github.com/Levironexe/architect --skill aws-s3-storage-c

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill prevents unsafe and costly file-handling patterns by guiding your C# backend to generate secure pre-signed S3 URLs, validate uploads, and store only object keys for long-term maintainability.

Core Features & Use Cases

  • Client-direct uploads with pre-signed URLs: Generate pre-signed PUT URLs for uploads and pre-signed GET URLs for downloads so your server never receives file bytes.
  • MIME allowlist validation before signing: Validate allowed content types in the presign step to block attackers from obtaining signed URLs for disallowed file types.
  • Key-based storage and on-demand signed downloads: Persist S3 object keys (not full URLs) in your database and generate signed download URLs when responding to clients.
  • Upload confirmation and server-side verification: Require the client to confirm uploads by calling an API endpoint with the key, and verify the object exists in S3 before saving.
  • DI-registered IAmazonS3 with safe credential sourcing: Register IAmazonS3 via dependency injection and rely on environment/IAM role credentials rather than hardcoding secrets.

Quick Start

Ask your coding agent to implement the presign and confirm endpoints plus the DI-registered StorageService using AWS SDK S3, storing only the returned object key in your database.

Frequently Asked Questions about AWS S3 Storage (C#)

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enable secure direct browser uploads to S3 from a C# backend?

Generate pre-signed PUT URLs in your C# backend so clients upload files directly to S3 without proxying bytes through your server. Validate MIME types before signing and verify object existence after upload confirmation.

Why should I store only the S3 object key instead of the full pre-signed URL in my database?

Storing only the S3 object key instead of the full pre-signed URL ensures long-term maintainability. You generate fresh signed download URLs on demand when responding to clients, preventing expired link issues and reducing database storage overhead.

How do I prevent users from uploading disallowed file types using pre-signed URLs?

Implement a server-side MIME allowlist validation during the presign step to block attackers from obtaining signed URLs for disallowed file types. This ensures clients can only upload approved content types directly to S3.

How do I verify an S3 direct upload succeeded without proxying file bytes through my server?

Require clients to call an API endpoint with the object key to confirm uploads. Your server then verifies the object exists in S3 before saving the key to your database, ensuring upload success without proxying file bytes.

Can I use dependency injection to manage AWS S3 credentials safely in C#?

Register IAmazonS3 as a singleton via dependency injection and source credentials from environment variables or IAM roles rather than hardcoding secrets. This ensures safe credential management for your C# application's S3 operations.

What are the limitations of using pre-signed URLs for browser-based media uploads?

Pre-signed URLs require strict server-side MIME validation to prevent disallowed file uploads and necessitate an upload confirmation step to verify S3 object existence. Additionally, you must persist only object keys to avoid expired download link issues.