How Do You Give an External Consultant 7-Day Access to One S3 Report?

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources. Determine appropriate data security controls.

Short answer

D Generate a presigned URL scoped to the annual report object and share it with the external consultant for the 7-day audit window.

Question

A company creates operations data and stores the data in an Amazon S3 bucket. For the company's annual audit, an external consultant needs to access an annual report that is stored in the S3 bucket. The external consultant needs to access the report for 7 days. The company must implement a solution to allow the external consultant access to only the report. Which solution will meet these requirements with the MOST operational efficiency?
  1. Create a new S3 bucket that is configured to host a public static website. Migrate the operations data to the new S3 bucket. Share the S3 website URL with the external consultant.
  2. Enable public access to the S3 bucket for 7 days. Remove access to the S3 bucket when the external consultant completes the audit.
  3. Create a new IAM user that has access to the report in the S3 bucket. Provide the access keys to the external consultant. Revoke the access keys after 7 days.
  4. Generate a presigned URL that has the required access to the location of the report on the S3 bucket. Share the presigned URL with the external consultant. Correct Answer

Key Takeaways

The question tests time-boxed, object-scoped S3 access for an external identity, and the trap is treating an IAM user with access keys as the 'safe' default even though it adds credential creation and manual revocation work.

Sharing a single Amazon S3 object with an external auditor for a fixed 7-day window is best solved with a presigned URL, which scopes time-limited access to just that report. This page confirms why option D beats public-bucket or IAM-user approaches on operational efficiency.

Common mistake: Most learners initially pick C, creating a new IAM user with access keys, because it feels more 'secure' than public access, but it requires managing long-lived credentials, scoping the policy to the object, and remembering to revoke keys after 7 days.

Expert Analysis

Why the Answer Is Correct

Option D is correct because a presigned URL encodes the signer's credentials, the object location, and an expiration into the URL itself, so the consultant can GET only the annual report and nothing else in the bucket. AWS CLI lets you set that expiry up to 604,800 seconds (7 days) for a SigV4 presigned URL, which maps exactly onto the stated requirement. Operationally there is nothing to build, nothing to tear down, and no public exposure: when the window closes, the link simply stops working. As Hkayne explained, presigned URLs work by appending the access key, expiration time, and SigV4 signature as query parameters, which is precisely the scoping behavior the scenario needs.

Why the Other Options Are Wrong

Option A fails on both effort and exposure: migrating the operations data into a new public static-website bucket is a heavy migration and would publish far more than the single annual report. Option B flips the bucket public for a week, so every object, including sensitive operations data, is reachable by anyone who guesses a key, and someone must remember to turn access off afterward. Option C does work functionally, but it means provisioning an IAM user, generating access keys, distributing long-lived secrets to a third party, and manually revoking them in 7 days; a forgotten revocation leaves standing credentials. LeonSauveterre walked through this same elimination, noting that with B "Even if you remove access after the 7 days, the bucket would be publicly accessible" and that with C you have to "revoke them after 7 days," which is easy to forget.

Community Comment Notes

Hkayne's explanation of what a presigned URL actually contains, the access key, expiry, and SigV4 signature as query parameters, is the cleanest technical justification for D in the thread. Scheldon added the practical detail that the CLI supports a 7-day expiry, the maximum allowed, and linked the AWS documentation page on sharing objects with presigned URLs. LeonSauveterre reinforced the rejection of B and C on exposure and manual-revocation grounds, and every recorded vote in the thread lands on D.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When the stem mentions an external party, a short fixed time window, and access to only one object, presigned URLs are the expected SAA-C03 answer; public bucket access and new IAM users with access keys are the distractor patterns. Check the expiry constraint too: 7 days is the maximum SigV4 presigned URL lifetime, so the requirement is deliberately feasible.

Frequently Asked Questions

Why is a new IAM user with access keys (Option C) less efficient than a presigned URL?

It creates long-lived credentials that must be scoped to the report, delivered to the consultant, and manually revoked after 7 days. A presigned URL expires automatically and grants object-level access only.

Can an S3 presigned URL really be valid for the full 7 days the consultant needs?

Yes. SigV4 presigned URLs generated with the AWS CLI can use --expires-in up to 604800 seconds (7 days), which matches the requirement exactly.

More SAA-C03 FAQ →

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. Hkayne 👍 5 Answered D
    Pre-signed URLs are used to provide short-term access to a private object in your S3 bucket. They work by appending an AWS Access Key, expiration time, and Sigv4 signature as query parameters to the S3 object.
  2. Scheldon 👍 4 Answered D
    AnswerD When using CLI to create presigned URL we can setup 7days (max) for URL expiration from the time of creation. https://docs.aws.amazon.com/AmazonS3/latest/userguide/ShareObjectPreSignedURL.html
  3. LeonSauveterre 👍 1 Answered D
    A - Yeah, too much trouble. B - Even if you remove access after the 7 days, the bucket would be publicly accessible during the time frame, which could lead to accidental data exposure. C - A little better than A, but you gotta create a new IAM user, provide access keys, and manually revok them after 7 days. I'm not even sure I can remember that a week later... D - No need to manage IAM users or keys. Also, everything you need to do can be done within 10 minutes.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide