Q88 — AWS SAA-C03 Ch.13

Question 88 of 100 | ← Chapter 13

Q988. A company wants to use an AWS CloudFormation stack for its application in a test environment. The company stores the CloudFormation template in an Amazon S3 bucket that blocks public access. The company wants to grant CloudFormation access to the template in the S3 bucket based on specific user requests to create the test environment. The solution must follow security best practices.Which solution will meet these requirements?

Correct Answer: C. Create a presigned URL for the template object. Configure the CloudFormation stack to use the presigned URL.

Explanation

To grant AWS CloudFormation access to a template stored in a private Amazon S3 bucket while following security best practices, the best solution is:C. Create a presigned URL for the template object. Configure the CloudFormation stack to use the presigned URL.Explanation:Presigned URL: A presigned URL allows temporary access to a specific S3 object without making the bucket public. By generating a presigned URL for the CloudFormation template, you can securely grant access to the template for a limited time based on specific user requests. This approach ensures that the S3 bucket remains private while still allowing CloudFormation to access the template when needed.Evaluation of Other Options:A. Create a gateway VPC endpoint for Amazon S3: While this allows S3 access from a VPC without using the public internet, it does not specifically address the requirement to access a private S3 object from CloudFormation based on user requests.B. Create an Amazon API Gateway REST API: This adds unnecessary complexity and does not directly solve the problem of providing access to a CloudFormation template stored in S3.D. Allow public access to the template object in the S3 bucket: This option is not a best practice as it exposes the S3 object to the public, potentially leading to security risks. Even temporarily allowing public access could lead to unintended exposure.In summary, Option C is the most secure and practical solution for granting CloudFormation access to a private S3 bucket while adhering to security best practices.