A company is hosting a workshop for external users and wants to share the reference documents with the external users for 7 days. The company stores the reference documents in an Amazon S3 bucket…

Question

Options

• AUse S3 presigned URLs to share the documents with the external users. Set an expiration time of
• BMove the documents to an Amazon WorkDocs folder. Share the links of the WorkDocs folder with
• CCreate temporary IAM users that have read-only access to the S3 bucket. Share the access keys
• DCreate a role that has read-only access to the S3 bucket. Share the Amazon Resource Name

• A
  83% (25)
• B
  3% (1)
• C
  10% (3)
• D
  3% (1)

Explanation

S3 presigned URLs are the most secure option because they grant time-limited, scoped access to specific S3 objects without exposing credentials or changing bucket permissions - setting a 7-day expiration means access automatically revokes itself, satisfying both the security and time-bound requirements.

Why the distractors fail:

• B (WorkDocs): Introduces unnecessary service complexity and doesn't leverage the existing S3 bucket; sharing WorkDoc links also doesn't inherently enforce a 7-day expiration on access.
• C (Temporary IAM users with access keys): IAM users are not meant for external parties - sharing access keys is a security anti-pattern, and managing/revoking temporary IAM users is operationally risky and error-prone.
• D (Sharing an IAM Role ARN): External users cannot assume a role simply by knowing its ARN; cross-account role assumption requires trust policy configuration on the external account, making this impractical and not a "sharing" mechanism for general external users.

Memory tip: Think of presigned URLs as a timed valet key - you hand someone access to exactly one thing, for exactly as long as you choose, and the key self-destructs. Whenever an exam question asks about temporary, scoped, credential-free external access to S3, presigned URLs is almost always the answer.

No community discussion yet for this question.