Q80 — AWS SAA-C03 Ch.12

Question 80 of 100 | ← Chapter 12

Q880. A company creates operations data and stores the data in an Amazon S3 bucket. For the company's annual audit, an external consultant needs to access an annual report that is stored in the S3 bucket. The external consultant needs to access the report for 7 days.The company must implement a solution to allow the external consultant access to only the report.Which solution will meet these requirements with the MOST operational efficiency?

• A. Create a new S3 bucket that is configured to host a public static website. Migrate the operations data to the new S3 bucket. Share the S3 website URL with the external consultant.
• B. Enable public access to the S3 bucket for 7 days. Remove access to the S3 bucket when the external consultant completes the audit.
• C. Create a new IAM user that has access to the report in the S3 bucket. Provide the access keys to the external consultant. Revoke the access keys after 7 days.
• D. Generate a presigned URL that has the required access to the location of the report on the S3 bucket.Share the presigned URL with the external consultant. ✓

Correct Answer: D. Generate a presigned URL that has the required access to the location of the report on the S3 bucket.Share the presigned URL with the external consultant.

Explanation

The solution that will meet the requirements with the MOST operational efficiency is option D: Generate a presigned URL that has the required access to the location of the report on the S3 bucket and share the presigned URL with the external consultant.A presigned URL is a URL that provides temporary access to an S3 object. It contains a signature that allows access to the specified resource and defines the duration of access. In this case, the company can generate a presigned URL for the specific report in the S3 bucket, with an expiration time of 7 days. The presigned URL can then be shared with the external consultant, who can use it to access the report for the specified period.This solution has the most operational efficiency because it provides temporary access to only the required report, without the need to create additional IAM users, manage access keys, or modify bucket permissions. The presigned URL automatically expires after the specified duration, ensuring that access is limited to the necessary time period.Option A suggests creating a new S3 bucket with public access and migrating the operations data. However, this approach may introduce security risks by making the entire bucket public, and it is not necessary to create a new bucket for this requirement.Option B suggests enabling public access to the S3 bucket for 7 days. This approach is not recommended because it grants public access to all objects in the bucket, not just the specific report required by the external consultant.Option C suggests creating a new IAM user with access to the report and providing access keys to the external consultant. While this approach can restrict access to the specific report, it requires creating and managing IAM users and access keys, which can be more operationally burdensome compared to generating a presigned URL.In summary, the solution that meets the requirements with the MOST operational efficiency is to generate a presigned URL with the required access to the report in the S3 bucket and share it with the external consultant (Option D).