Can you lock a presigned url to a key without creating a new ACL?

[bertabus-zz]

currently I am creating presigned url using the following code:

func GenSignedURL(key string) (string, error) {
    svc := s3.New(&aws.Config{
        Credentials: credentials.NewChainCredentials(
            []credentials.Provider{
                &AppEngProvider{},
                &credentials.EnvProvider{},
            }),
        Endpoint:   "",
        Region:     "us-west-2",
        DisableSSL: false,
        LogLevel:   0,
    })

    req, _ := svc.GetObjectRequest(&s3.GetObjectInput{
        Bucket: aws.String("myBucket"),
        Key:    aws.String(key),
    })

    URL, err := req.Presign(300 * time.Second)
    if err != nil {
        return "", err
    }
    return URL, nil
}

I can then test the upload using curl with the presigned url. Problem I encounter is that I can change the key specific part of the url and upload to any directory or file I want. Is this the expected behavior? Is the key intended only for convenience in generating the URL?

[lsegal]

@bertabus are your other objects in the bucket by any chance marked as public-read or have some other ACL that would make them accessible without a presigned URL? That's what I'm thinking is happening. Presigned URLs should be signed for a specific key, since the signature contains the path portion of the request.

[bertabus-zz]

@lsegal right you are. My permissions were wide open. I locked them down and couldn't upload anything at all. I was following a snippet I had found in the comments to issue #26 that suggested something similar to the code above. I have since noticed that there is a "PutObjectRequest" and "PutObjectInput". I updated my code and everything works exactly as I was expecting. Thanks