AWS Certified Sysops Administrator Associate · Free Practice Question Medium
Question 3
A company needs to find a way to securely share an object from an Amazon S3 bucket that does not have public access enabled. The users who will be accessing the object do not have an AWS account.
What is the MOST operationally efficient solution that will meet this requirement?
-
A
Generate a presigned URL for the object. Share the URL with the users.
-
B
Attach an S3 bucket policy that only allows object downloads from the users' IP addresses.
-
C
Create an IAM role that has access to the object. Instruct the users to assume the role.
-
D
Create an application that distributes signed cookies to the users and control access through the cookies.
Reveal correct answer
Correct answer: A
Explanation
All objects by default are private. Only the object owner has permission to access these objects. However, the object owner can optionally share objects with others by creating a presigned URL, using their own security credentials, to grant time-limited permission to download the objects.
When you create a presigned URL for your object, you must provide your security credentials, specify a bucket name, an object key, specify the HTTP method (GET to download the object) and expiration date and time. The presigned URLs are valid only for the specified duration.
Anyone who receives the presigned URL can then access the object. For example, if you have a video in your bucket and both the bucket and the object are private, you can share the video with others by generating a presigned URL.
CORRECT: "Generate a presigned URL for the object. Share the URL with the users" is the correct answer.
INCORRECT: "Attach an S3 bucket policy that only allows object downloads from the users' IP addresses" is incorrect. This is not operationally efficient as the users’ IP addresses may change and need to be updated.
INCORRECT: " Create an IAM role that has access to the object. Instruct the users to assume the rol " is incorrect. This adds complexity and the users need to be able to assume the IAM role.
INCORRECT: "Create an application that distributes signed cookies to the users and control access through the cookies" is incorrect. Signed cookies are used with CloudFront but not directly with Amazon S3.
References:
https://docs.aws.amazon.com/AmazonS3/latest/userguide/ShareObjectPreSignedURL.html
Save time with our AWS cheat sheets:
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
