Here's an example. It uses the machine's role credentials automatically. If you want to specify a secret manually, you'll have to read the documentation.
I can't guarantee it's uptodate, but something similar to this should work.
---
// SignGetRequest returns a signed URL for downloading s3://{{bucket}}/{{key}}
// with a given time-to-live.
func SignGetRequest(bucket, key string, ttl time.Duration) (string, error) {
svc := s3.New(nil)
req, _ := svc.GetObjectRequest(&s3.GetObjectInput{
Bucket: aws.String(bucket),
Key: aws.String(key),
})
url, err := req.Presign(ttl)
if err != nil {
return "", &RequestError{path: path.Join(bucket, key), baseError: err}
}
return url, nil
}