SAA-C03 Q632 · Security

Question

A media company is launching a new product platform that artists from around the world can use to upload videos and images directly to an Amazon S3 bucket. The company owns and maintains the S3 bucket. The artists must be able to upload files from personal devices without the need for AWS credentials or an AWS account. Which solution will meet these requirements MOST securely?

Accepted Answer

**Option C: Use an IAM role to generate presigned URLs for artist-specific S3 prefixes.**

Let's map each requirement to the solution:

1. **Artists must upload without AWS credentials or an AWS account**: Presigned URLs embed temporary authorization directly in the URL itself. The URL contains a signature derived from the IAM role's credentials, so the artist never needs AWS credentials — they simply HTTP PUT to the URL.

2. **MOST securely**: Presigned URLs are time-limited (they expire after a configurable duration), scoped to a specific S3 object key/prefix, and limited to the specific HTTP method (PUT for upload). This follows the **principle of least privilege** — each artist gets access only to their own prefix, only for uploads, and only for a limited time.

3. **Company owns and m

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips