SAA-C03 Practice Question 81: S3 Presigned URL Upload
AWS Certified Solutions Architect – Associate (SAA-C03) · Test 9 · question 1 of 10
A claims portal lets policyholders upload a supporting document straight from their browser to an S3 bucket. The bucket must stay private, the policyholders have no AWS accounts and must never receive AWS credentials, and each upload authorisation should be usable only for that one object key and only for the next 15 minutes.
Which approach should the architect use?
Show answer and explanation
Answer:
A presigned URL grants time-limited access to a specific object without changing the bucket policy. AWS calls out this exact use case: a presigned URL lets someone upload a specific object to your bucket without that party having AWS security credentials or permissions. The URL is created by the back end using its own IAM principal's permissions, and carries the bucket, the object key, the HTTP method and an expiration interval, so a 15-minute, single-key PUT is precisely what the mechanism expresses. The bucket stays private throughout.
Option A makes the bucket world-writable. Anyone who finds the bucket name can write objects to it, and unguessable keys are secrecy rather than authorisation, nothing stops an attacker filling the bucket with objects at keys of their own choosing.
Option B hands out long-lived AWS credentials to a browser, which is the single worst outcome here. It also creates an IAM user per customer, which does not scale and is not what IAM users are for.
Option D confuses two unrelated settings. CORS governs which web origins a browser may make requests from; it grants no permission at all. Disabling Block Public Access and then allowing writes would reproduce option A's problem, and neither setting can be scoped to one key for fifteen minutes.