AWS Certified Solutions Architect – Associate (SAA-C03)Design Secure ArchitecturesMedium
A global enterprise needs to securely share large datasets stored in an Amazon S3 bucket with external partners for a limited time. The partners do not have AWS accounts, and the solution must not require them to install any special software or manage credentials. Which is the most secure and efficient way to achieve this?
- AConfigure S3 bucket policies to allow public read access to specific objects.
- BGenerate S3 pre-signed URLs for the specific objects.
- CUse AWS DataSync to transfer the data to the partners' on-premises storage.
- DCreate IAM users for each partner and grant them direct S3 access.
Show answer & explanationAnswer & explanation
Correct answer: B. Generate S3 pre-signed URLs for the specific objects.
S3 pre-signed URLs provide temporary, time-limited access to specific S3 objects using standard HTTP/HTTPS requests, without requiring AWS credentials or special software for the external partners. This meets all requirements for secure, efficient, and temporary sharing.
Why the other options are wrong
- A. Allowing public read access to specific objects is generally not secure for sensitive datasets and lacks time-based access control.
- C. AWS DataSync is designed for large-scale data transfers between storage services, not for sharing individual objects with external partners who lack AWS accounts or specialized software.
- D. Creating IAM users for external partners is an operational overhead and requires them to manage AWS credentials, which is not desired.
S3 Pre-signed URLs
Amazon S3 pre-signed URLs allow temporary, time-limited access to specific S3 objects using standard HTTP/HTTPS requests, without requiring AWS security credentials for the user.
- Grants temporary access to an object.
- URL contains security credentials and an expiration date.
- Does not require the recipient to have an AWS account or credentials.
- Can be used for uploads (PUT) or downloads (GET).
Memory trick: Pre-signed URLs Permit Partner Access Privately and Temporarily.