Granting CloudFormation Access to Private S3 Templates

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

C Create a presigned URL for the template object and configure the CloudFormation stack to use it.

Question

A company wants to use an AWS CloudFormation stack for its application in a test environment. The company stores the CloudFormation template in an Amazon S3 bucket that blocks public access. The company wants to grant CloudFormation access to the template in the S3 bucket based on specific user requests to create the test environment. The solution must follow security best practices. Which solution will meet these requirements?
  1. Create a gateway VPC endpoint for Amazon S3. Configure the CloudFormation stack to use the S3 object URL.
  2. Create an Amazon API Gateway REST API that has the S3 bucket as the target. Configure the CloudFormation stack to use the API Gateway URL.
  3. Create a presigned URL for the template object. Configure the CloudFormation stack to use the presigned URL. Correct Answer
  4. Allow public access to the template object in the S3 bucket. Block the public access after the test environment is created.

Key Takeaways

The core concept is securing S3 object access for external services; the common trap is assuming VPC endpoints can be used for regional services like CloudFormation which operate outside the VPC boundary.

This question addresses secure access design for AWS CloudFormation when templates are stored in private Amazon S3 buckets. It establishes that presigned URLs provide the necessary temporary, authenticated access without exposing the resource publicly.

Common mistake: Many learners select Option A (Gateway VPC Endpoint) because it aligns with general security best practices for private S3 access. However, this fails because CloudFormation is a regional control-plane service and cannot utilize VPC endpoints located within customer VPCs.

Expert Analysis

Why the Answer Is Correct

Option C is correct because CloudFormation is a regional service that operates outside of any specific VPC. When a template is stored in a private S3 bucket (public access blocked), CloudFormation needs a way to retrieve it securely. A presigned URL provides temporary, authenticated access to a specific S3 object using the caller's credentials, satisfying the requirement for specific user requests while maintaining security.

Why the Other Options Are Wrong

Option A is incorrect because Gateway VPC Endpoints only work for traffic originating from within a VPC. Since CloudFormation runs on AWS infrastructure outside your VPC, it cannot route through a Gateway Endpoint. Option B is incorrect because API Gateway does not natively fetch S3 objects for CloudFormation stacks without complex Lambda integration, which is not specified. Option D is insecure as it involves temporarily opening public access, violating the principle of least privilege and security best practices.

Community Comment Notes

Community members correctly identified that CloudFormation is a regional service, making VPC endpoints invalid. As one commenter noted, "Cloudformation is a regional service so is outside the vpc." Another highlighted that presigned URLs grant temporary access without public exposure. The consensus supports C as the only viable technical solution among the choices.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Always check the service scope (Regional vs Global) when considering VPC networking solutions. Regional services like CloudFormation, Route 53 (hosted zones), or IAM cannot use VPC Endpoints because they do not run inside your VPC.

Frequently Asked Questions

Why can't I use a VPC Endpoint for CloudFormation?

CloudFormation is a regional service running on AWS infrastructure, not inside your VPC. VPC endpoints only handle traffic originating from within a VPC.

Is a presigned URL secure enough for production?

Yes, for temporary access. It uses signed credentials and expires automatically, ensuring no permanent public access or long-lived secrets are exposed.

More SAA-C03 FAQ →

Community Votes

C
67%
A
33%

67% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

  1. AnasAWS 👍 5 Answered C
    https://docs.aws.amazon.com/AmazonS3/latest/userguide/ShareObjectPreSignedURL.html
  2. FlyingHawk 👍 2 Answered A
    OptionA the gateway endpoint for S3 provides private access to the S3 template, aligns with security best practices, and incurs no additional costs. Option C (presigned URLs) potentially exposing the template to the public internet, even if temporarily. You only use C for the following reasons If you need a quick, temporary solution for granting access to the template. If you are not using a VPC or do not want to set up a VPC endpoint. If the template is not highly sensitive and temporary public exposure is acceptable.
  3. robotgeek 👍 2 Answered A
    The question states "specific user requests" meaning a shared URL does not meet the requirement. BUT with gateway VPC endpoint you can specify custom policies as in the following link https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-access.html
  4. Dantecito 👍 1 Answered C
    C. Not the most secure but the only that works. A. Cloudformation is a regional service so is outside the vpc and gateway VPC endpoint only works inside a VPC. B. Doesn't do anything, we need a lambda between api gateway and cloudformation. D. public access is a no.
  5. pujithacg8 👍 1
    C, A presigned URL grants temporary access to an S3 object without making it publicly accessible.
Show 1 more comment
  1. flaviobrf 👍 2 Answered C
    For me C is the right answer

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide