Exam AWS Certified Developer - Associate DVA-C02 topic 1 question 271 discussion

A. Creating an EC2 instance profile and role with an appropriate policy and associating the role with the EC2 instances follows the principle of least privilege. The EC2 instances will have temporary security credentials provided by the role, and the permissions granted to the role can be tightly controlled using IAM policies. This approach eliminates the need to manage and store long-term access keys on the EC2 instances, which can be a security risk. C. Using the S3 GeneratePresignedUrl API call allows the application to generate time-limited URLs that provide temporary access to objects in the S3 bucket. These pre-signed URLs can be generated for authenticated users, ensuring that only authorized users can access the objects. This approach ensures that the objects in the S3 bucket remain private and are not publicly accessible.

A is correct. No doubt about it. My problem with C is this: ok, ive generated the presigned URL... now what? You need to update the app to USE de generated url, and there is no mention of that. Im going with E.

Option C: Modify the application to use the S3 GeneratePresignedUrl API call: Generate a pre-signed URL for each object in the S3 bucket. Provide the pre-signed URL to authenticated users. Users can use the pre-signed URL to download objects directly from S3 without exposing the bucket publicly. Option E: Modify the application to delegate requests to the S3 bucket: Ensure that the application handles authentication and authorization. When a user requests an object, the application verifies their credentials and then retrieves the object from S3. This approach allows fine-grained control over access.

AC is the correct answer.

Presigned Url and appropriate policy

Cree un usuario de IAM con una política adecuada (opción B): El desarrollador debe crear un usuario de IAM en AWS con una política que permita el acceso a los objetos del depósito S3 solo a los usuarios autenticados en la aplicación. Esta política debe tener permisos adecuados para acceder y descargar objetos del depósito S3. Modifique la aplicación para utilizar la llamada API S3 GeneratePresignedUrl (opción C): El desarrollador debe modificar la aplicación para utilizar la llamada API S3 GeneratePresignedUrl. Esta llamada generará una URL prefirmada que contiene una firma de seguridad y un tiempo de expiración. Solo los usuarios autenticados que tengan acceso a esta URL prefirmada podrán descargar los objetos del depósito S3.

Option E: Modifying the application to delegate requests to the S3 bucket is less secure than using pre-signed URLs. If the application acts as a proxy for S3 requests, it would need to handle the data transfer from S3 to the user, which can increase the load on the application and potentially expose the application to additional security risks.