SAA-C03 Question 279
Select 2A company is running a web application that allows users to upload and retrieve images. They use Amazon S3 to store the images and need to ensure that only authenticated users can access their own files. The solution must be cost-effective and minimize management overhead. Which combination of approaches will meet these requirements?
- A
Use an S3 bucket policy to allow public read and write access.
- B
Use S3 pre-signed URLs to grant users temporary access to upload and retrieve their files.
- C
Enable Amazon S3 Transfer Acceleration to increase upload and download speeds.
- D
Integrate the application with AWS IAM and leverage fine-grained permissions for individual users.
- E
Use an AWS Lambda function triggered by an API Gateway to generate pre-signed URLs dynamically for user-specific file access.
Show answer and explanation
Correct answers: B, E
Explanation
The combination of using S3 pre-signed URLs (Option 2) and dynamically generating them with an AWS Lambda function triggered by an API Gateway (Option 5) provides a secure, scalable, and cost-effective solution. Pre-signed URLs ensure that only authenticated users can securely access their specific files. Using Lambda to generate these URLs dynamically reduces management overhead and ensures the solution can scale with the application.
- A. Incorrect.
Allowing public read and write access via an S3 bucket policy would compromise security and does not meet the requirement of authenticating users.
- B. Correct.
Using S3 pre-signed URLs allows the application to provide temporary, secure access to individual users for uploading or retrieving files, meeting the authentication and authorization requirements.
- C. Incorrect.
Amazon S3 Transfer Acceleration improves upload and download speeds but does not address authentication or authorization, which are key requirements in this scenario.
- D. Incorrect.
While IAM provides powerful access control, configuring fine-grained permissions for individual users at scale introduces significant management overhead, which violates the requirement to minimize complexity.
- E. Correct.
Using a Lambda function with API Gateway to dynamically generate user-specific pre-signed URLs provides a scalable and cost-effective solution for authenticating users and granting secure access to their files.