AWS Certified SysOps Administrator – Associate (legacy) — Question 131

You have private video content in S3 that you want to serve to subscribed users on the Internet. User IDs, credentials, and subscriptions are stored in an Amazon
RDS database.
Which configuration will allow you to securely serve private content to your users?

Answer options

• A. Generate pre-signed URLs for each user as they request access to protected S3 content
• B. Create an IAM user for each subscribed user and assign the GetObject permission to each IAM user
• C. Create an S3 bucket policy that limits access to your private content to only your subscribed users' credentials
• D. Create a CloudFront Origin Identity user for your subscribed users and assign the GetObject permission to this user

Correct answer: A

Explanation

Generating pre-signed URLs allows you to securely grant time-limited access to private S3 content without exposing your AWS credentials. The other options either require creating numerous IAM users, which is impractical for large numbers of subscribers, or do not provide adequate security without exposing credentials or using less secure methods of access control.