Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsUse the AWS SDK for JavaScript v3 to put objects in Amazon S3, then configure Amazon CloudFront to serve them from an S3 origin. For a private bucket, use CloudFront Origin Access Control (OAC) so CloudFront—not the public internet—can read the origin. Decide separately whether viewers may access CloudFront URLs freely or need signed URLs or cookies.
This guide explains the architecture, upload choices, and CloudFront settings that need to match your application. AWS’s documentation supports the design choices below, but the account-specific IAM policy, bucket policy, cache policy, and CORS rules must be set for your use case.
How the S3 and CloudFront flow works
Amazon S3 stores the objects; CloudFront serves them from edge locations using an S3 bucket origin. Your Node.js application can upload through its trusted server, or issue a presigned S3 URL so a client can upload directly without receiving AWS credentials. For a private origin, CloudFront OAC authorizes CloudFront to read from S3 while the bucket remains private. OAC does not authenticate viewers: use CloudFront signed URLs or signed cookies if access to delivered content must be restricted.
- Choose an upload path. Upload from your Node.js server when it must inspect or transform the file. Use a presigned URL when the client should transfer directly to S3.
- Choose object keys deliberately. An upload to an existing key replaces that object. Use unique or version-aware keys if replacement is not intended.
- Configure the S3 origin. For OAC, select the bucket’s regional S3 REST endpoint, not its website endpoint.
- Set CloudFront access and request behavior. Configure OAC and bucket permissions, viewer authorization if needed, methods, HTTPS, caching, and CORS to fit the application.
Upload objects from Node.js
Upload through your application server
Use AWS SDK for JavaScript v3 S3 operations when the server should retain control of the transfer—for example, to inspect or transform data before storing it. Consult AWS’s Amazon S3 examples using SDK for JavaScript (v3) for operation examples. Keep AWS credentials on the trusted server rather than exposing them to browser clients.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Let clients upload with presigned URLs
A presigned URL authorizes a specific S3 operation without giving its recipient general AWS credentials. Its authority is bounded by the permissions of the principal that signed it, so scope those permissions to the objects and actions the application actually needs. AWS documents the flow in Uploading objects with presigned URLs.
Plan the key before issuing the URL: uploading to a key that already exists replaces the object. If files should not overwrite one another, generate unique keys or use a version-aware naming scheme in the application.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Handle large uploads
AWS documents @aws-sdk/lib-storage for multipart upload support in SDK v3, and @aws-sdk/s3-request-presigner for presigning. See AWS’s Amazon S3 considerations for the package guidance. If multipart upload requests go through CloudFront to S3, configure OAC and grant the required S3 permissions; AWS describes the supported origin request methods in its request and response behavior for S3 origins.
Keep the S3 origin private with OAC
For a private bucket served through CloudFront, configure Origin Access Control and grant the distribution the S3 permissions it needs. Prevent public bucket access so viewers cannot bypass CloudFront by requesting S3 URLs directly. AWS recommends OAC over the legacy Origin Access Identity (OAI); OAC supports features including SSE-KMS and dynamic requests. AWS also specifies that S3 Object Ownership must be set to Bucket owner enforced when using OAC with an S3 bucket origin. Follow AWS’s guidance for restricting access to an S3 origin.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Use the bucket’s regional S3 REST endpoint as the origin. An S3 website endpoint is treated as a custom origin, and OAC and OAI do not apply to it. AWS explains the distinction in Use various origins with CloudFront distributions.
Decide who may view delivered objects
Origin access and viewer access are separate controls. OAC limits how CloudFront reaches S3; it does not limit who can open a CloudFront URL. If the content is public, an open CloudFront URL may be appropriate. For private content, CloudFront signed URLs or signed cookies can restrict access by expiration time, optional start time, and optional IP range. Restrict direct S3 access as well, or viewers could bypass the CloudFront controls. See AWS’s guidance on restricting access to files and serving private content with signed URLs and signed cookies.
Rank #4
- 【Versatile Storage Expansion – For Gaming, Work & Everyday Use】 Running out of space on your PS5 or Xbox Series X/S? This external hard drive lets you store and play PS4 / Xbox One games directly, instantly freeing up your console’s internal storage for next‑gen titles. At the same time, it handles work file backups, media libraries, and cross‑device data transfers with ease. One drive, all your needs. *（Note: PS5 / Xbox Series X|S games cannot be run or stored directly from the external hard drive. However, by offloading your PS4 / Xbox One games, you can free up valuable space for newer titles.）*
- 【Patented Silicone Sleeve – Data Protection You Can Count On】 Worried about drops? We’ve got you covered. The patented built‑in silicone sleeve acts like a shock‑absorbing armor, cushioning your drive against bumps and falls. Whether it’s important work documents, precious family photos, or hard‑earned game saves, your data deserves this level of protection.
- 【Plug & Play, Compatible with Computers & Consoles】 No complicated setup—just plug in and go. Works seamlessly with Windows, Mac, and Linux computers, as well as PS4, PS5, Xbox One, and Xbox Series X/S. Process files at the office, back up data at home, or enjoy gaming in your downtime—one drive handles all your devices, simply and hassle‑free.
- 【USB 3.0 Ultra‑Fast Transfer – No More Waiting】 Tired of watching progress bars crawl? With USB 3.0 speeds up to 5Gbps, large files transfer in seconds. Whether you’re moving work documents, transferring hundreds of gigs of games, or backing up a year’s worth of photos, you get more done in less time.
- 【Sleek, Lightweight, and Ready to Go】 Weighing just 0.16 kg—lighter than a can of soda—this compact drive features a stylish mirror‑and‑frosted finish. Toss it in your bag and go, whether you’re heading to the office, visiting a friend for a gaming session, or giving a presentation on the road.
Configure methods, HTTPS, CORS, and caching
Forward only the HTTP methods you need
CloudFront can forward GET, HEAD, OPTIONS, PUT, PATCH, POST, and DELETE when configured to allow all supported methods. Enable only those required by the application, and limit the bucket permissions accordingly so an unnecessarily broad method configuration does not grant unwanted write or delete capability. CloudFront caches GET and HEAD by default behavior; the other listed methods are not cached. AWS documents this in its S3-origin request and response behavior.
Require HTTPS without breaking uploads
Set the viewer protocol policy to HTTPS only or redirect HTTP to HTTPS, according to the application’s needs. There is an important difference for non-GET requests: AWS documents that redirect-to-HTTPS behavior returns 403 for HTTP DELETE, OPTIONS, PATCH, POST, and PUT requests. Ensure upload clients use HTTPS rather than relying on a redirect for these methods. See AWS’s HTTPS requirements for communication with an S3 origin.
Best Value
- High capacity in a small enclosure – The small, lightweight design offers up to 6TB* capacity, making WD Elements portable hard drives the ideal companion for consumers on the go.
- Plug-and-play expandability
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- SuperSpeed USB 3.2 Gen 1 (5Gbps)
Make CORS behavior match browser requests
If browser cross-origin requests must follow S3 CORS rules through CloudFront, forward the selected request headers and configure the cache behavior to handle request variants correctly. S3 ignores cookies forwarded by CloudFront, so do not rely on forwarded cookies to control S3 CORS behavior. AWS covers the origin request and response behavior in its S3-origin documentation.
Choose caching for the object lifecycle
Set cache keys and TTLs according to how objects change and how access is authorized; there is no single correct cache policy for every application. CloudFront caches GET and HEAD, so a same-key replacement in S3 should not be assumed to appear immediately at every edge. For rapidly changing objects, plan for cache invalidation or use versioned object names. AWS’s S3-origin behavior documentation describes caching and S3 validator behavior.
Choose the upload and delivery pattern
| Decision | Use this when | Key consideration |
|---|---|---|
| Server-side upload | The application must inspect or transform data before S3 storage. | Keep credentials on the trusted server; use SDK v3 S3 operations. |
| Presigned S3 upload | Clients should transfer directly to S3 without AWS credentials. | The signing principal’s permissions bound the URL; a same-key upload replaces the object. |
| Private S3 origin with OAC | CloudFront should be authorized to read a private S3 bucket. | Use the regional REST endpoint, configure the bucket and distribution together, and prevent public direct access. |
| Signed CloudFront URLs or cookies | Only authorized viewers should access delivered content. | These restrict viewer access; OAC alone does not. |
| CloudFront-forwarded uploads | Requests need to pass through the distribution to S3. | Configure required methods and OAC permissions, and account for HTTPS and CORS behavior. |
Verify the access paths and request behavior
Before relying on the setup, check it with the application’s intended behavior and permissions:
Quick Recap
- Confirm the Node.js upload flow writes to the intended bucket and key.
- Confirm an upload to an existing key has the replacement behavior your application expects.
- For a private origin, check that the CloudFront distribution can retrieve the object while a direct S3 URL cannot be used to bypass the distribution.
- If viewer access is restricted, test both an authorized signed request and an unauthorized or expired request.
- For uploads through CloudFront, verify that the configured methods, HTTPS policy, CORS request headers, and bucket permissions support the specific requests the client makes.
- For frequently updated objects, verify the expected edge behavior and use invalidation or versioned names where freshness matters.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
