Q86 — AWS SAA-C03 Ch.14

Question 86 of 100 | ← Chapter 14

Q1086. A media company is launching a new product platform that artists from around the world can use to upload videos and images directly to an Amazon S3 bucket. The company owns and maintains the S3 bucket. The artists must be able to upload files from personal devices without the need for AWS credentials or an AWS account.Which solution wil1 meet these requirements MOST securely?

• A. Enable cross-origin resource sharing (CORS) on the S3 bucket.
• B. Turn off block public access for the S3 bucket. Share the bucket URL to the artists to enable uploads without credentials.
• C. Use an IAM role that has upload permissions for the S3 bucket to generate presigned URLs for S3 prefixes that are specific to each artist. Share the URLs to the artists. ✓
• D. Create a web interface that uses an IAM role that has permission to upload and view objects in the S3 bucket. Share the web interface URL to the artists.

Correct Answer: C. Use an IAM role that has upload permissions for the S3 bucket to generate presigned URLs for S3 prefixes that are specific to each artist. Share the URLs to the artists.

Explanation

To meet the media company's requirements securely, we need to consider the need for artists to upload files to an Amazon S3 bucket without requiring AWS credentials or an AWS account. We must also ensure that the solution is secure and adheres to best practices for handling sensitive data and access controls.Let's evaluate each option:A. Enable cross-origin resource sharing (CORS) on the S3 bucket. CORS allows web applications that are running in a browser on one domain to interact with resources in a different domain, which is typically used for allowing certain HTTP requests from a web page on one origin to a resource on a different origin. However, CORS alone does not allow users to upload files without credentials. It's mainly used for accessing resources via AJAX calls, not for allowing unauthenticated uploads.B. Turn off block public access for the S3 bucket. Share the bucket URL to the artists to enable uploads without credentials.Turning off block public access would make the bucket publicly writable, which is a security risk. It exposes the bucket to any unauthorized uploads from the internet, making it vulnerable to abuse and potential data breaches.C. Use an IAM role that has upload permissions for the S3 bucket to generate presigned URLs for S3 prefixes that are specific to each artist. Share the URLs to the artists. Presigned URLs allow you to give temporary access to an S3 object. In this case, you can generate a presigned URL with an upload permission for a specific S3 object prefix (which could be associated with each artist). The artists can use this URL to upload files to the S3 bucket without needing AWS credentials. This approach is secure because it limits the access to a specific action (upload) and for a limited time.D. Create a web interface that uses an IAM role that has permission to upload and view objects in the S3 bucket. Share the web interface URL to the artists.While this option could technically work, it requires the media company to build, maintain, and secure a web interface. It also exposes more surface area for potential security vulnerabilities. Furthermore, if the web interface is compromised, it could potentially allow unauthorized access to the S3 bucket.Given these considerations, the most secure solution that meets the requirements is:C. Use an IAM role that has upload permissions for the S3 bucket to generate presigned URLs for S3 prefixes that are specific to each artist. Share the URLs to the artists.This approach allows secure, unauthenticated uploads while maintaining control over who can upload and where they can upload.