# Private links without wiring up S3, CloudFront and Cognito

S3, CloudFront and Cognito give you full control: your account, a global CDN, your sign-in rules, and you pay for what you use. artifact.guru gives what your AI makes a private link with email invites, view tracking and versions, with nothing to build.

## Pick Amazon S3, CloudFront and Cognito if

- Files must stay in your own AWS account, under your own IAM policies.
- Viewers have to sign in through your SAML or OIDC identity provider.
- You have engineers to build and run S3, CloudFront, Cognito and Lambda@Edge.

## Pick artifact.guru if

- You want a private link today, with no bucket, distribution or sign-in to wire up.
- Your agent should publish from Claude, ChatGPT, Codex, Gemini CLI or Grok with no stack to set up first.
- You want to see by name who opened an email link, and who hasn’t.

## Amazon S3, CloudFront and Cognito and artifact.guru, row by row

| Question | Amazon S3, CloudFront and Cognito | artifact.guru |
| --- | --- | --- |
| Publish from AI agents | AWS MCP Server lets agents call any AWS API, S3 uploads included; also CLI and SDKs | Claude, ChatGPT, Codex, Gemini CLI, Grok and any MCP app, over OAuth; no API keys |
| Upload it yourself | Drag files and folders into the S3 console, up to 160 GB per file | Drag in files, or a whole folder for a built site or React app |
| What opens in the browser | Any file, served as stored with the Content-Type you set | HTML, React, Markdown, PDF, Word, PowerPoint, Excel, images, diagrams, zipped sites |
| Who can open a link | Private S3 origin; expiring signed URLs or cookies; Cognito sign-in via Lambda@Edge | Private, public or secret code on every plan; email invites (up to 50) on paid plans |
| Who opened it | CloudFront reports: popular files, top referrers, devices, browsers, locations | Paid plans: names on email links; counts, sources and devices on the rest |
| Updates and versions | S3 Versioning keeps every overwrite so you can restore it; off by default | Every change is a new version at the same link; roll back any time (Free keeps 3) |
| Your own domain | Your domain on CloudFront with a free ACM certificate; you add the DNS records | Your subdomain for public and secret-code links, from $12 a month |
| Team workspace | IAM users, roles and policies; IAM Identity Center for team sign-in | Team: one workspace, admins and members, a project per client, comments you can assign |
| Price | Usage-based: S3 $0.023/GB-month (US East); CloudFront 1 TB/month free; Cognito 10k MAU free (50 via SAML/OIDC) | Free $0; Individual $12/month; Team $30/month for 3 editors, then $8 each |

## Where Amazon S3, CloudFront and Cognito is good

- Files stay in your own AWS account under your IAM policies, and S3 is audited under SOC, PCI DSS, FedRAMP and HIPAA programs.
- Cognito can put email, Google, Apple or any SAML or OIDC sign-in, with MFA, in front of CloudFront through Lambda@Edge.
- Agents can drive it: the AWS MCP Server, generally available since May 2026, lets Claude Code, Codex and Gemini CLI call any AWS API at no extra charge.

## Where artifact.guru is different

- Nothing to build or keep running. Agents publish over MCP from Claude, ChatGPT (Business, Enterprise or Edu), Codex, Gemini CLI and Grok after a one-time browser approval, or you drag in files or a whole folder.
- Access is a setting, not a project: private, email invites for up to 50 addresses, an 8-character secret code that can expire, or public. Switch any time and the link stays the same.
- Email links show each person who opened, when and how often, and who hasn’t opened yet. Public and code links show counts, where visitors came from and devices.
- PDF, Word and PowerPoint open in the browser next to HTML, React, Markdown, Mermaid and Excalidraw. Every edit is a new version at the same link, with rollback.

## Moving over from Amazon S3, CloudFront and Cognito

1. Pull the files or the built site folder you share down from your bucket.
2. Drag them into artifact.guru, or have your agent publish them over MCP. Each one starts private.
3. Pick who can open each link. On a paid plan, serve public and code links from a subdomain like docs.yourcompany.com.

## Questions

### Is artifact.guru cheaper than S3, CloudFront and Cognito?

Not always. AWS bills for usage and its free tiers cover a lot: CloudFront includes 1 TB and 10 million requests a month, and Cognito 10,000 monthly active users, or 50 who sign in through SAML or OIDC. artifact.guru is $0, $12 or $30 a month (Team includes 3 editors) with nothing to build.

### Can viewers sign in with our company identity provider?

On AWS, yes: Cognito accepts SAML and OIDC providers. artifact.guru has no viewer SSO. You invite up to 50 email addresses per artifact and each person signs in with that address, or you share a secret code.

### Can my AI agent publish to AWS directly?

Yes. The AWS MCP Server lets agents call AWS APIs, including uploads to S3, but someone, or the agent, still has to set up the bucket, distribution and sign-in. With artifact.guru you approve once in the browser and the agent publishes. Publishing from ChatGPT needs a Business, Enterprise or Edu workspace.

### Can artifact.guru run inside our AWS account?

No, there is no self-hosting. HTML, React and sites run in a sandbox on a separate address, usercontent.artifact.guru, with no access to the viewer’s account.

## Sources

What this page says about Amazon S3, CloudFront and Cognito comes from its own pages, checked on October 8, 2026. Plans and prices change; if something is out of date, tell us at [Support](https://artifact.guru/support).

- [Amazon S3 pricing](https://aws.amazon.com/s3/pricing/)
- [CloudFront flat-rate pricing plans](https://aws.amazon.com/cloudfront/pricing/)
- [CloudFront pay-as-you-go pricing](https://aws.amazon.com/cloudfront/pricing/pay-as-you-go/)
- [Amazon Cognito pricing](https://aws.amazon.com/cognito/pricing/)
- [AWS Free Tier](https://aws.amazon.com/free/)
- [CloudFront private content](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html)
- [CloudFront signed URLs with a custom policy](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-creating-signed-url-custom-policy.html)
- [CloudFront origin access control for S3](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html)
- [Authorization@Edge with Cognito (AWS blog)](https://aws.amazon.com/blogs/networking-and-content-delivery/authorizationedge-using-cookies-protect-your-amazon-cloudfront-content-from-being-downloaded-by-unauthenticated-users/)
- [Cognito user pools](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools.html)
- [CloudFront reports](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/reports.html)
- [CloudFront viewers reports](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/viewers-reports.html)
- [S3 Versioning](https://docs.aws.amazon.com/AmazonS3/latest/userguide/Versioning.html)
- [S3 uploads](https://docs.aws.amazon.com/AmazonS3/latest/userguide/upload-objects.html)
- [S3 object metadata](https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingMetadata.html)
- [S3 compliance validation](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-compliance.html)
- [CloudFront alternate domain names](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/CNAMEs.html)
- [AWS Certificate Manager pricing](https://aws.amazon.com/certificate-manager/pricing/)
- [IAM Identity Center](https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html)
- [AWS MCP Server is generally available (May 2026)](https://aws.amazon.com/about-aws/whats-new/2026/05/aws-mcp-server/)
- [Setting up the AWS MCP Server](https://docs.aws.amazon.com/agent-toolkit/latest/userguide/getting-started-aws-mcp-server.html)
- [AWS Price List API: S3 in US East](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonS3/current/us-east-1/index.json)

Source: https://artifact.guru/alternatives/aws-s3