Presigned POST does not apply x-amz-tagging to uploaded S3 object

[johnnybishop]

Checkboxes for prior research

• I've gone through Developer Guide and API reference
• I've checked AWS Forums and StackOverflow.
• I've searched for previous similar issues and didn't find any solution.

Describe the bug

Description

When uploading an object to S3 using a presigned POST URL generated with the AWS SDK for JavaScript (v3), the object is uploaded successfully and metadata fields (e.g. x-amz-meta-*) are applied, but tags specified via x-amz-tagging are not applied to the object.

According to the documentation, it should be possible to specify tags using x-amz-tagging during upload. However, this appears to be silently ignored when using a presigned POST, even though the same tag string works with PUT presigned URLs.

SDK Version

"@aws-sdk/client-s3": "^3.825.0"
"@aws-sdk/s3-presigned-post": "^3.825.0"

Please advise whether this is a bug, an unsupported feature for presigned POST, or if we are misusing the SDK. If unsupported, we recommend clarifying this in the SDK and S3 documentation.

Regression Issue

• Select this option if this issue appears to be a regression.

SDK version number

@aws-sdk/s3-presigned-post@3.825.0

Which JavaScript Runtime is this issue in?

Node.js

Details of the browser/Node.js/ReactNative version

22.9.0

Reproduction Steps

import {
  GetObjectCommand,
  HeadObjectCommandOutput,
  PutObjectCommand,
  PutObjectCommandInput,
  S3,
} from '@aws-sdk/client-s3';
import { getSignedUrl } from '@aws-sdk/s3-request-presigner';
import {
  createPresignedPost,
  PresignedPostOptions,
} from '@aws-sdk/s3-presigned-post';
import { createReadStream } from 'fs';
import FormData from 'form-data';

const tagString = 'tag1=abcd&tag2=efgh';

const options: PresignedPostOptions = {
  Bucket: 'my-bucket',
  Key: 'test-object.json',
  Expires: 3600,
  Conditions: [
    ['content-length-range', 0, 10485760], // 10MB max
    { bucket: 'my-bucket' },
    { key: 'test-object.json' },
    { 'x-amz-tagging': tagString }, // included in conditions
  ],
  Fields: {
    'x-amz-tagging': tagString, // included in form fields
  },
};

const { url, fields } = await createPresignedPost(s3Client, options);

const form = new FormData();
for (const [key, value] of Object.entries(fields)) {
  form.append(key, value);
}
form.append('file', fs.createReadStream('/Users/test/test.json'));

form.submit(url, (err, res) => {
  // Upload succeeds
});

Observed Behavior

After upload, the object exists but has no tags. The x-amz-tagging string does not take effect.

Expected Behavior

Tags passed via the x-amz-tagging field and allowed in policy conditions should be applied to the object during upload, as per documentation and the behavior with PUT presigned URLs.

Possible Solution

No response

Additional Information/Context

• Using a PUT presigned URL with x-amz-tagging works correctly.
• Lambda executing the code has full access to S3 service
• No error is thrown — the upload appears successful, but tags are not applied.

[aBurmeseDev]

Hi @johnnybishop, thanks for checking in.

I'm not able to reproduce this with code below. Can you share your logs?

Code

import { createPresignedPost } from "@aws-sdk/s3-presigned-post";
import { S3Client } from "@aws-sdk/client-s3";

const client = new S3Client({ region: "us-west-1" });

const config = {
    Bucket: "testbucket",
    Key: 'test',
    Fields: {
        'x-amz-tagging': 'tagString',
    }
}

try {
    const response = await createPresignedPost(client, config);
    console.log(response)
} catch (error) {
    console.log(error)
}

Logs

{
  url: 'https://s3.us-west-1.amazonaws.com/testbucket/5321',
  fields: {
    'x-amz-tagging': 'tagString',
    bucket: 'testbucket-5321',
    'X-Amz-Algorithm': 'AWS4-HMAC-SHA256',
    'X-Amz-Credential': 'REDACTED/20220616/us-west-1/s3/aws4_request',
    'X-Amz-Date': '20220616T210700Z',
    key: 'test',
    Policy: <your policy / auto generated policy here>,
    'X-Amz-Signature': REDACTED
  }
}

[johnnybishop]

@aBurmeseDev here is full working example with bucket creation and tag verification after form is submitted:

import {
    S3,
    CreateBucketCommand,
    HeadBucketCommand,
    GetObjectTaggingCommand,
} from '@aws-sdk/client-s3';
import { createPresignedPost } from '@aws-sdk/s3-presigned-post';
import { createReadStream, promises as fs } from 'fs';
import FormData from 'form-data';
import path from 'path';

async function uploadDynamicJsonFile() {
    const bucketName = 'my-bucket-' + Date.now(); // unique bucket name
    const objectKey = 'test-object.json';
    const filePath = path.resolve('/tmp', objectKey);
    const tagString = 'tag1=abcd&tag2=efgh';

    const s3Client = new S3({
        endpoint: 'http://127.0.0.1:9090/',
        region: 'us-east-1',
        credentials: {
            accessKeyId: 'top',
            secretAccessKey: 'secret',
        },
        forcePathStyle: true, // required for localstack/minio
    });

    // Step 1: Create the bucket if it doesn't exist
    try {
        await s3Client.send(new HeadBucketCommand({ Bucket: bucketName }));
        console.log(`✅ Bucket already exists: ${bucketName}`);
    } catch {
        try {
            await s3Client.send(new CreateBucketCommand({ Bucket: bucketName }));
            console.log(`✅ Bucket created: ${bucketName}`);
        } catch (err) {
            console.error('❌ Error creating bucket:', err);
            return;
        }
    }

    // Step 2: Write a JSON file
    const data = {
        message: 'This file was generated dynamically',
        timestamp: new Date().toISOString(),
    };

    try {
        await fs.writeFile(filePath, JSON.stringify(data, null, 2));
        console.log(`✅ File created at ${filePath}`);
    } catch (err) {
        console.error('❌ Error writing file:', err);
        return;
    }

    // Step 3: Generate a presigned POST
    const options = {
        Bucket: bucketName,
        Key: objectKey,
        Expires: 3600,
        Conditions: [
            ['content-length-range', 0, 10485760],
            { bucket: bucketName },
            { key: objectKey },
            { 'x-amz-tagging': tagString },
        ],
        Fields: {
            'x-amz-tagging': tagString,
        },
    };

    let url, fields;
    try {
        ({ url, fields } = await createPresignedPost(s3Client, options));
    } catch (err) {
        console.error('❌ Error creating presigned POST:', err);
        return;
    }

    // Step 4: Submit the form
    const form = new FormData();
    for (const [key, value] of Object.entries(fields)) {
        form.append(key, value);
    }
    form.append('file', createReadStream(filePath));

    form.submit(url, async (err, res) => {
        if (err) {
            console.error('❌ Error submitting form:', err);
            return;
        }

        console.log('✅ Upload complete. Status:', res.statusCode);
        res.resume();

        // Step 5: Check object tags
        try {
            const taggingResult = await s3Client.send(
                new GetObjectTaggingCommand({
                    Bucket: bucketName,
                    Key: objectKey,
                })
            );

            console.log('✅ Object tags:');
            for (const tag of taggingResult.TagSet || []) {
                console.log(`  - ${tag.Key} = ${tag.Value}`);
            }
        } catch (tagErr) {
            console.error('❌ Failed to retrieve object tagging:', tagErr);
        }
    });
}

uploadDynamicJsonFile();

[aBurmeseDev]

In order to further assist you, please share the code snippet that's not adding x-amz-tagging and its logs.

[johnnybishop]

I think we have some kind of misunderstanding here. The ticket is about not adding tags to the object on S3 upload via the POST url. So i don't understand why should i remove the x-amz-tagging property. What i'm looking for is answer to the following question: "Does upload to S3 with presigned POST url support object tagging? If yes, tell me how to achieve that because documentation does not do that.".

[de-tester]

Dear future me, if the next time you'd try to use tags with presigned POST requests here's the way to do it.

x-amz-tagging is not something post request recognize in both headers and form fields, regardless of the examples and some confusing documentation. It recognize tagging field.
So in order to get it working you need to use following code:

createPresignedPost(client, {
   Bucket: bucketName,
   Key: objectKey,
   Expires: 3600,
   Conditions: [
      ['content-length-range', 0, 56_214_400]
   ],
   Fields: {
      tagging: '<Tagging><TagSet><Tag><Key>tag</Key><Value>test</Value></Tag></TagSet></Tagging>'
   }
});

I hope this helps and you won't spend so much time trying to figure out why the hell it does not work.
PS: tagging can be in the conditions as well, it just defines would get it in the fields payload right away or it'll be just a part of the policy. No need to put it in the both places anyway.

/cc @johnnybishop

[johnnybishop]

Thank you @de-tester, this works.
@aBurmeseDev you should definetely make documentation more verbose about how to tag objects with presigned POST.

[github-actions]

This issue is now closed. Comments on closed issues are hard for our team to see.
If you need more assistance, please open a new issue that references this one.