Beyond taking advantage of validations that are enforced with IAM policies, you can also have a background job handle making thumbnails or whatever you want. A

Beyond taking advantage of validations that are enforced with IAM policies, you can also have a background job handle making thumbnails or whatever you want. Also I don't think the Content-Type is actually verified by S3 so technically users can still upload malicious files such as an executable with a png extension. On the bright side, S3 supports requesting a range of bytes. You can use that to perform validation server side afterwards to enforce it's really a png, jpg or whatever format you want. Here's examples in Python and Ruby to verify common image types by reading bytes: https://nickjanetakis.com/blog/validate-file-types-by-reading-the-first-few-bytes-of-a-file https://nickjanetakis.com/blog/validate-file-types-by-readin...