SCS-C03 · Question #26
A company runs an application on an Amazon EC2 instance. The application generates invoices and stores them in an Amazon S3 bucket. The instance profile that is attached to the instance has…
The correct answer is B. Add a StringEquals condition to the IAM role policy for the EC2 instance profile. Configure the. Amazon S3 pre-signed URLs grant temporary access based on the permissions of the principal that generates them. AWS Certified Security - Specialty documentation explains that fine-grained authorization can be enforced by combining pre-signed URLs with IAM policy conditions. By…
Question
A company runs an application on an Amazon EC2 instance. The application generates invoices and stores them in an Amazon S3 bucket. The instance profile that is attached to the instance has appropriate access to the S3 bucket. The company needs to share each invoice with multiple clients that do not have AWS credentials. Each client must be able to download only the client's own invoices. Clients must download their invoices within 1 hour of invoice creation. Clients must use only temporary credentials to access the company's AWS resources. Which additional step will meet these requirements?
Options
- AUpdate the S3 bucket policy to ensure that clients that use pre-signed URLs have the S3:Get*
- BAdd a StringEquals condition to the IAM role policy for the EC2 instance profile. Configure the
- CUpdate the script to use AWS Security Token Service (AWS STS) to obtain new credentials each
- DGenerate an access key and a secret key for an IAM user that has S3:GetObject permissions on
How the community answered
(44 responses)- A7% (3)
- B82% (36)
- C9% (4)
- D2% (1)
Explanation
Amazon S3 pre-signed URLs grant temporary access based on the permissions of the principal that generates them. AWS Certified Security - Specialty documentation explains that fine-grained authorization can be enforced by combining pre-signed URLs with IAM policy conditions. By tagging each invoice object with a client identifier and adding a condition to the EC2 instance role policy using s3:ResourceTag/ClientId, the role can generate pre-signed URLs only for objects associated with a specific client. This ensures that each client can access only their own invoices, even though the URLs are temporary and unauthenticated. Option A over-permissions clients. Option C is unnecessary because instance profiles already use temporary credentials. Option D violates AWS best practices by using long-term credentials. AWS recommends resource tagging with IAM policy conditions for scalable, secure access
Topics
Community Discussion
No community discussion yet for this question.