Temporary credentials (AWS STS, S3 presigned URLs): SCS-C03 study notes and practice questions
What to know about Temporary credentials (AWS STS, S3 presigned URLs) for the SCS-C03 exam, from the Identity and Access Management domain (20% of the exam guide), then 1 free question to test it. Part of the SCS-C03 study guide.
These questions test whether you can pick the right way to get short-lived access and whether you know its limits. The usual pattern is a workload, a user or a shared link that needs access for a fixed period, and an answer that either holds credentials longer than needed or assumes a lifetime that the credentials cannot reach.
The facts that decide answers
AssumeRole returns credentials for a role. The default session is 1 hour, and a role’s maximum session duration can be set from 1 to 12 hours. The caller can request a shorter session, but not a longer one than the role allows.
Role chaining (a role assuming another role using role credentials) caps the session at 1 hour, whatever the role’s maximum is set to.
AssumeRoleWithSAML and AssumeRoleWithWebIdentity trade a SAML assertion or an OIDC token for credentials. The caller needs no AWS credentials first. Federated sign-in through an identity provider works this way, and Identity Center and Cognito identity pools build on the same idea.
GetSessionToken gives temporary credentials for an IAM user. When the user signs in with MFA, the session carries that context, so a policy can require aws:MultiFactorAuthPresent.
Presigned URLs sign a request with the signer’s credentials. A SigV4 presigned URL can last up to 7 days, but it stops working when the signing credentials expire. A URL made with a one-hour role session dies after an hour.
Revoking sessions: you cannot cancel temporary credentials. The standard response is a deny policy on aws:TokenIssueTime that blocks sessions issued before a chosen time.
sts:SourceIdentity is set when a role is assumed and carries through role chaining, so CloudTrail can show the real person behind a shared role.
How to choose
Scenario wording
Pick
Workforce user needs an account role, with no long-term keys
Identity Center permission set, which issues short-lived role sessions
Mobile app user needs AWS credentials scoped to that user
Cognito identity pool, which exchanges the user’s token for role credentials
A SAML-based identity provider needs direct access to a role
AssumeRoleWithSAML
Share one object with a partner for 10 minutes without giving credentials
S3 presigned URL signed by a role with a short session
Access must end right away for a role’s current sessions
Deny policy on aws:TokenIssueTime
Audit must show the individual behind a shared role
sts:SourceIdentity set during AssumeRole
Access longer than 12 hours from a role
Not possible in one session; design for re-authentication
Common traps
Assuming a presigned URL lasts its stated expiry. The signer’s credentials can expire first.
Assuming role chaining can exceed one hour. It cannot.
Believing active temporary credentials can be deleted. They remain valid until they expire, which is why the aws:TokenIssueTime deny exists.
Using long-term access keys for a job that an assumed role handles with no stored secret.
Using GetFederationToken for new designs. Roles are the preferred pattern.
A legal publisher sells research reports as PDF files stored in a private Amazon S3 bucket. Customers download reports through a web portal, and each download link must stay valid for seven days so that customers can save it for later.
The security policy forbids long-lived IAM access keys in any application, and the bucket must stay private with no public access. A Lambda function generates each link using its execution role.
Which solution meets these requirements?
Choose one answer.
AA. Generate S3 presigned URLs with a seven-day expiry in the Lambda function, using the role's temporary credentials to sign them. Keep the bucket private, and rely on the expiry time to limit how long each report can be downloaded.
BB. Create an IAM user for the portal, generate access keys, and use them to sign seven-day presigned URLs. Rotate the keys every 90 days, and store them in AWS Secrets Manager for the Lambda function to read.
CC. Make the report objects publicly readable, and give customers the plain object URLs. Add a lifecycle rule that deletes each report seven days after upload, so that the links stop working after that period.
DD. Serve the reports through Amazon CloudFront with an origin access control on the private bucket. Sign CloudFront URLs with a key group that has a seven-day expiry, and generate the signed URLs in the portal.
Show the answer and explanation
Answer: D
A. Wrong: A presigned URL stops working when the temporary credentials that signed it expire, which happens long before seven days. Setting a longer expiry in the URL does not extend the life of the role session.
B. Wrong: Long-term keys can sign seven-day presigned URLs, so the links would work as required. The policy forbids long-lived access keys, however, and rotating them every 90 days does not change that they are long-lived.
C. Wrong: Public objects break the private bucket requirement, and anyone with a URL could read a report. A lifecycle rule would delete the report itself after seven days, rather than expire the customer link.
D. Right: Correct. CloudFront signed URLs are checked against a key pair in a trusted key group, not against the Lambda role session, so seven-day links work. Origin access control keeps the bucket private, and no IAM access keys are needed. Learn more: Using CloudFront signed URLs (opens in a new tab)
Explanation
A presigned S3 URL cannot outlive the credentials that signed it, and role sessions are temporary. CloudFront signed URLs use a key pair in a trusted key group, so seven-day links work while the bucket stays private behind origin access control. Long-term keys, public objects, and a lifecycle rule each break a stated requirement.
Want more on Temporary credentials (AWS STS, S3 presigned URLs)? The 5 full-length practice sets have 6 more Temporary credentials (AWS STS, S3 presigned URLs) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study Temporary credentials (AWS STS, S3 presigned URLs)