Exams / DVA-C02 / Amazon S3 for developers / Question 1
DVA-C02 practice question: Amazon S3 for developers
Development with AWS Services A free question from our original DVA-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
A mobile app lets users upload profile photos. The developer does not want AWS credentials in the app. A Lambda function behind Amazon API Gateway generates an S3 presigned PUT URL for each upload with an expiry of 24 hours. Users report that URLs stop working after a few hours. What explains this?
Choose one answer.
- AA. Presigned URLs for uploads can never be valid for more than one hour.
- BB. The bucket must have versioning enabled for presigned uploads to work.
- CC. A presigned URL stops working when the temporary credentials that signed it expire.
- DD. The mobile app must also send the user's IAM access key with each upload.
Show the answer and explanation
Answer: C
- A. Wrong: Presigned URLs created with the CLI or SDKs can be valid for up to seven days. The limit here comes from the credentials.
- B. Wrong: Versioning is not needed for presigned uploads, and it would not make URLs expire.
- C. Right: Correct. The function signs with its execution role's temporary credentials, and the URL expires with them, whatever expiry was requested.
- D. Wrong: The point of a presigned URL is that the user needs no AWS credentials. The URL carries the signer's authority.
Explanation
A presigned URL lets someone without AWS credentials upload or download an object with the permissions of whoever signed it. Its lifetime is the shorter of the requested expiry and the lifetime of the signing credentials. URLs signed with IAM role session credentials, as in Lambda, expire when that session does.
Study
Keep practising
Answer questions with a score at the end, or practise just this topic with the explanation after each one. No sign-up needed.