SCS-C03 practice question: Temporary credentials (AWS STS, S3 presigned URLs)
Identity and Access Management A free question from our original SCS-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A legal publisher sells research reports as PDF files stored in a private Amazon S3 bucket. Customers download reports through a web portal, and each download link must stay valid for seven days so that customers can save it for later.
The security policy forbids long-lived IAM access keys in any application, and the bucket must stay private with no public access. A Lambda function generates each link using its execution role.
Which solution meets these requirements?
Choose one answer.
AA. Generate S3 presigned URLs with a seven-day expiry in the Lambda function, using the role's temporary credentials to sign them. Keep the bucket private, and rely on the expiry time to limit how long each report can be downloaded.
BB. Create an IAM user for the portal, generate access keys, and use them to sign seven-day presigned URLs. Rotate the keys every 90 days, and store them in AWS Secrets Manager for the Lambda function to read.
CC. Make the report objects publicly readable, and give customers the plain object URLs. Add a lifecycle rule that deletes each report seven days after upload, so that the links stop working after that period.
DD. Serve the reports through Amazon CloudFront with an origin access control on the private bucket. Sign CloudFront URLs with a key group that has a seven-day expiry, and generate the signed URLs in the portal.
Show the answer and explanation
Answer: D
A. Wrong: A presigned URL stops working when the temporary credentials that signed it expire, which happens long before seven days. Setting a longer expiry in the URL does not extend the life of the role session.
B. Wrong: Long-term keys can sign seven-day presigned URLs, so the links would work as required. The policy forbids long-lived access keys, however, and rotating them every 90 days does not change that they are long-lived.
C. Wrong: Public objects break the private bucket requirement, and anyone with a URL could read a report. A lifecycle rule would delete the report itself after seven days, rather than expire the customer link.
D. Right: Correct. CloudFront signed URLs are checked against a key pair in a trusted key group, not against the Lambda role session, so seven-day links work. Origin access control keeps the bucket private, and no IAM access keys are needed. Learn more: Using CloudFront signed URLs (opens in a new tab)
Explanation
A presigned S3 URL cannot outlive the credentials that signed it, and role sessions are temporary. CloudFront signed URLs use a key pair in a trusted key group, so seven-day links work while the bucket stays private behind origin access control. Long-term keys, public objects, and a lifecycle rule each break a stated requirement.
Want more on Temporary credentials (AWS STS, S3 presigned URLs)? The 5 full-length practice sets have 6 more Temporary credentials (AWS STS, S3 presigned URLs) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →