Exam AWS-SysOps topic 1 question 570 discussion

Exam question from Amazon's AWS-SysOps

Question #: 570
Topic #: 1

A company must share monthly report files that are uploaded to Amazon S3 with a third party. The third-party user list is dynamic, is distributed, and changes frequently. The least amount of access must be granted to the third party. Administrative overhead must be low for the internal teams who manage the process.
How can this be accomplished while providing the LEAST amount of access to the third party?

A. Allow only specified IP addresses to access the S3 buckets which will host files that need to be provided to the third party.
B. Create an IAM role with the appropriate access to the S3 bucket, and grant login permissions to the console for the third party to access the S3 bucket.
C. Create a pre-signed URL that can be distributed by email to the third party, allowing it to download specific S3 filed.
D. Have the third party sign up for an AWS account, and grant it cross-account access to the appropriate S3 bucket in the source account.

Show Suggested Answer

Suggested Answer: A 🗳️

by mukeshs at Sept. 24, 2019, 2:14 a.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

mukeshs

Highly Voted 3 years, 3 months ago

I think the answer should be C. Creating an bucket policy by specifying IP address is not an access with least priviledge.

upvoted 6 times

...

e45af42

Most Recent 7 months ago

Selected Answer: C

It is definitely C answer. Why admins do not update such an old question???

upvoted 1 times

...

albert_kuo

1 year, 5 months ago

Selected Answer: C

A pre-signed URL is a time-limited URL generated by the AWS SDK or API. It grants temporary access to specific objects in an S3 bucket, without the need for the third party to have AWS credentials or direct access to the S3 bucket.

upvoted 1 times

...

babaEniola

3 years, 1 month ago

I will go for B, it says Administrative overhead must be low, if you give a pre-signed URL you have to keep generating it all the time, but a role, once the least policy is attached, there won't be any internal administrative work to do.

upvoted 1 times

...

TroyMcLure

3 years, 1 month ago

Correct Answer: C

upvoted 1 times

...

ImranR

3 years, 1 month ago

C is correct..

upvoted 1 times

...

Kt45

3 years, 2 months ago

I'd say A only because C doesn't address the admin overhead with distributing the url to all recipients in the distribution list. There would also be a need for some sort of automation. With A, least access can be achieved with read access only and allowing specific IPs

upvoted 2 times

shimmy

3 years, 1 month ago

A has even more administrative overhead because you have to constantly add IP addresses and remove IP addresses. With C, I just have to update the email distribution list.

upvoted 2 times

...