AWS Certified Solutions Architect – Associate (SAA-C03) — Question 883

A company wants to use an AWS CloudFormation stack for its application in a test environment. The company stores the CloudFormation template in an Amazon S3 bucket that blocks public access. The company wants to grant CloudFormation access to the template in the S3 bucket based on specific user requests to create the test environment. The solution must follow security best practices.

Which solution will meet these requirements?

Answer options

• A. Create a gateway VPC endpoint for Amazon S3. Configure the CloudFormation stack to use the S3 object URL.
• B. Create an Amazon API Gateway REST API that has the S3 bucket as the target. Configure the CloudFormation stack to use the API Gateway URL.
• C. Create a presigned URL for the template object. Configure the CloudFormation stack to use the presigned URL.
• D. Allow public access to the template object in the S3 bucket. Block the public access after the test environment is created.

Correct answer: C

Explanation

Generating an Amazon S3 presigned URL is the most secure method because it grants temporary read access to the CloudFormation service for the private template object without altering the bucket's public access settings. Options A and B do not provide a mechanism for CloudFormation to authenticate and access the private S3 object directly. Option D violates security best practices by temporarily exposing the template to the public internet, which introduces security risks.