AWS Certified Solutions Architect Associate · Free Practice Question Medium
Question 39
An application upgrade caused some issues with stability. The application owner enabled logging and has generated a 5 GB log file in an Amazon S3 bucket. The log file must be securely shared with the application vendor to troubleshoot the issues.
What is the MOST secure way to share the log file?
-
A
Create an IAM user for the vendor to provide access to the S3 bucket and the application. Enforce multi-factor authentication.
-
B
Enable default encryption for the bucket and public access. Provide the S3 URL of the file to the vendor.
-
C
Create access keys using an administrative account and share the access key ID and secret access key with the vendor.
-
D
Generate a presigned URL and ask the vendor to download the log file before the URL expires.
Reveal correct answer
Correct answer: D
Explanation
A presigned URL gives you access to the object identified in the URL. When you create a presigned URL, you must provide your security credentials and then specify a bucket name, an object key, an HTTP method (PUT for uploading objects), and an expiration date and time. The presigned URLs are valid only for the specified duration. That is, you must start the action before the expiration date and time.
This is the most secure way to provide the vendor with time-limited access to the log file in the S3 bucket.
CORRECT: "Generate a presigned URL and ask the vendor to download the log file before the URL expires" is the correct answer.
INCORRECT: "Create an IAM user for the vendor to provide access to the S3 bucket and the application. Enforce multi-factor authentication" is incorrect. This is less secure as you have to create an account to access AWS and then ensure you lock down the account appropriately.
INCORRECT: "Create access keys using an administrative account and share the access key ID and secret access key with the vendor" is incorrect. This is extremely insecure as the access keys will provide administrative permissions to AWS and should never be shared.
INCORRECT: "Enable default encryption for the bucket and public access. Provide the S3 URL of the file to the vendor" is incorrect. Encryption does not assist here as the bucket would be public and anyone could access it.
References:
https://docs.aws.amazon.com/AmazonS3/latest/userguide/ShareObjectPreSignedURL.html
Save time with our AWS cheat sheets:
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
