I'm creating a pre-signed URL so the user in the front end can upload a file (max 10MB) this is how I create it

  const s3Params = {
        Bucket: S3_BUCKET,
        Expires: 30,
        Fields: {
            key: key,
        },
        Conditions: [
            ["eq", "$acl", "public-read"],
            ["eq", "$x-amz-meta-filename", fileName],
            ["content-length-range", 1, 10000000], //10MB
            ["eq", "$x-amz-meta-userid", userid],
        ],
    };

    console.log(s3Params);

    s3.createPresignedPost(s3Params, (err, data) => {
        if (err) {
            console.log(err);
            return cb({success: false, error: err});
        }

        data.fields["x-amz-meta-filename"] = fileName;
        data.fields["x-amz-meta-userid"] = userid;

        const returnData = {
            signedRequest: data,
            url: `https://${S3_BUCKET}.s3.amazonaws.com/${key}`,
        };
        return cb({success: true, data: {returnData}});
    });

in the Conditions set the max file size (content-length-range) to be 10MB but I was still able to upload a 25 MB file using the generated Pre signed URL. I was thinking it might have something to do with the bucket policy but I'm not sure.

Here is my Bucket Policy

    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "PublicReadGetObject",
            "Effect": "Allow",
            "Principal": "*",
            "Action": [
                "s3:GetObject",
                "s3:PutObject"
            ],
            "Resource": "arn:aws:s3:::blah.blah/*"
        }
    ]
}