Q95 — AWS SAA-C03 Ch.14

Question 95 of 100 | ← Chapter 14

Q1095. A media company hosts a web application on AWS. The application gives users the ability to upload and viewvideos. The application stores the videos in an Amazon S3 bucket.The company wants to ensure that only authenticated users can upload videos. Authenticated users must have theability to upload videos only within a specified time frame after authentication.Which solution will meet these requirements with the LEAST operational overhead?

• A. Configure the application to generate IAM temporary security credentials for authenticated users.
• B. Create an AWS Lambda function that generates pre-signed URLs when a user authenticates. ✓
• C. Develop a custom authentication service that integrates with Amazon Cognito to control and log direct S3bucket access through the application.
• D. Use AWS Security Token Service (AWS STS) to assume a pre-defined IAM role that grants authenticated userstemporary permissions to upload videos directly to the S3 bucket.

Correct Answer: B. Create an AWS Lambda function that generates pre-signed URLs when a user authenticates.

Explanation

To determine the best solution for a media company's web application that needs to ensure only authenticated users can upload videos within a specified time frame after authentication, let's analyze each option:A. Configure the application to generate IAM temporary security credentials for authenticated users.This option involves the application directly handling the generation of IAM credentials, which can be complex and potentially insecure if not implemented correctly. It requires the application to have permissions to create and manage IAM credentials, which could introduce security risks and operational overhead.B. Create an AWS Lambda function that generates pre-signed URLs when a user authenticates.Pre-signed URLs allow temporary access to an S3 bucket, enabling users to upload files without giving them direct access to the bucket. Lambda can generate these URLs upon user authentication, and they can be configured with an expiration time that aligns with the specified time frame. This approach minimizes operational overhead and security risks, as Lambda functions can be triggered by authentication events and do not require complex IAM credential management within the application. C. Develop a custom authentication service that integrates with Amazon Cognito to control and log direct S3 bucket access through the application.This solution involves developing and maintaining a custom service, which can be complex and costly. It also requires integrating with Amazon Cognito for authentication, and then implementing additional logic to control and log access to the S3 bucket. This adds significant operational overhead. D. Use AWS Security Token Service (AWS STS) to assume a pre-defined IAM role that grants authenticated users temporary permissions to upload videos directly to the S3 bucket.While AWS STS can be used to assume IAM roles and grant temporary permissions, this approach typically involves more complexity in managing IAM roles and policies. It also requires the application to handle the assumption of roles, which can add operational overhead and potential security risks if not implemented securely.Given the need to minimize operational overhead while ensuring that only authenticated users can upload videos within a specified time frame, Option B is the most suitable solution:Option B leverages AWS Lambda to generate pre-signed URLs upon user authentication, aligning perfectly with the requirement for temporary access within a specified time frame. Lambda functions are serverless, which means they do not require server management, reducing operational overhead.Pre-signed URLs provide a secure and straightforward way to grant temporary access to S3 without exposing bucket credentials.Thus, the media company should use Option B to meet the requirements with the least operational overhead.