ExamPark
Course menuDVA-C03

Exams / DVA-C03 / Amazon S3 for developers / Question 1

DVA-C03 practice question: Amazon S3 for developers

Development with AWS Services A free question from our original DVA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

A mobile app uploads profile photos straight to an Amazon S3 bucket, so the app holds no AWS credentials.

An AWS Lambda function behind Amazon API Gateway generates a presigned PUT URL, with a 24-hour expiry, for each upload. The app caches each URL and reuses it for later uploads.

Users report that uploads made from cached URLs fail several hours after the URL was issued, even though the URL states a 24-hour expiry. The team still wants no long-lived keys in the app.

What should the developer do?

Choose one answer.

  1. A. Request a fresh presigned URL from the API for each upload, since it stops working when the signing credentials expire.
  2. B. Lower the expiry to 60 minutes and cache each URL for a day, because presigned URLs created with the SDKs are capped at one hour.
  3. C. Embed an IAM user's access key in the app, so that each URL is signed by a long-lived key that never expires and can be cached.
  4. D. Turn on S3 versioning on the bucket, so that the earlier URLs stay valid for the whole 24 hours of the expiry they were given.
Show the answer and explanation

Answer: A

  • A. Right: Correct. A presigned URL stops working when the credentials that signed it expire, whatever expiry was requested. A fresh URL, signed by live credentials, avoids the early failure. Learn more: Sharing objects with presigned URLs (opens in a new tab)
  • B. Wrong: The SDKs allow an expiry of up to seven days, so the cap is not the problem. The cause is that the signing credentials expire first.
  • C. Wrong: A key in the app is a long-lived credential that anyone can extract. It breaks the no-credentials rule, and it is not how presigned URLs are meant to be used.
  • D. Wrong: Versioning keeps earlier versions of objects. It does not change how long a presigned URL works.

Explanation

A presigned URL expires at whichever comes first, its requested expiry or the expiry of the credentials that signed it. The Lambda role session ends first, so cached URLs fail early. Requesting a URL when an upload starts avoids this without putting long-lived keys in the app.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free DVA-C03 practice examPractice Amazon S3 for developersAll Amazon S3 for developers questions

Want more on Amazon S3 for developers? The 5 full-length practice sets have 5 more Amazon S3 for developers questions, 390 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets