Exam AWS Certified Security - Specialty topic 1 question 484 discussion

Exam question from Amazon's AWS Certified Security - Specialty

Question #: 484
Topic #: 1

[All AWS Certified Security - Specialty Questions]

A web application gives users the ability to log in, verify their membership’s validity, and browse artifacts that are stored in an Amazon S3 bucket. When a user attempts to download an object, the application must verify the permission to access the object and allow the user to download the object from a custom domain name such as example.com.

What is the MOST secure way for a security engineer to implement this functionality?

A. Configure read-only access to the object by using a bucket ACL. Remove the access after a set time has elapsed.
B. Implement an IAM policy to give the user read access to the S3 bucket.
C. Create an S3 presigned URL. Provide the S3 presigned URL to the user through the application.
D. Create an Amazon CloudFront signed URL. Provide the CloudFront signed URL to the user through the application.

Show Suggested Answer

Suggested Answer: D 🗳️

by cloudenthusiast at June 2, 2023, 7 p.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

6_8ftwin

Highly Voted 2 years ago

Selected Answer: D

For this scenario you would need to set up static website hosting because a custom domain name is listed as a requirement. "Amazon S3 website endpoints do not support HTTPS or access points. If you want to use HTTPS, you can use Amazon CloudFront to serve a static website hosted on Amazon S3." This is not secure. https://docs.aws.amazon.com/AmazonS3/latest/userguide/website-hosting-custom-domain-walkthrough.html CloudFront signed URLs allow much more fine-grained control as well as HTTPS access with custom domain names: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-signed-urls.html

upvoted 5 times

...

sunny1417

Most Recent 2 years ago

Selected Answer: D

D is correct.

upvoted 2 times

...

OCHT

2 years ago

Selected Answer: D

Option A would not be the best choice for this scenario. Let's break down why: Changing ACLs for individual users and objects each time a download is requested could become complex and difficult to manage. It's also not clear how you would "remove the access after a set time has elapsed" as this would require some kind of automated mechanism to modify the ACLs. Finally, using ACLs in this way would not fulfill the requirement to "allow the user to download the object from a custom domain name such as example.com." In contrast, a CloudFront signed URL (Option D) allows for precise access control on a per-request basis, can easily be set to expire after a certain period, and supports the use of custom domain names. This makes it a better fit for the requirements of the scenario.

upvoted 3 times

...

cloudenthusiast

2 years ago

Selected Answer: D

By using CloudFront signed URLs, the security engineer can implement fine-grained access control to the S3 objects. Users will only be able to access the objects for a limited period specified in the signed URL. This approach ensures that the user's permissions are verified each time they attempt to access an object, providing robust security and preventing unauthorized access.

upvoted 2 times

...