Signed object URLs with s3Sign
ctx.http.authed(alias).s3Sign(url, options?) returns a presigned S3 URL for an AWS S3 credential: a time-limited URL that grants access to one object with no credentials attached, so uploads and downloads go directly to S3 rather than through your function. Sign GET for downloads (the default) or PUT for uploads, with a configurable expiresIn (default 15 minutes, maximum one week). The result is { url, method, expiresAt }, and the URL only works with the method it was signed for.