Exam AWS Certified Developer - Associate DVA-C02 topic 1 question 3 discussion

D I actually apply this solution the production applications. Examples https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_s3_cognito-bucket.html https://docs.amplify.aws/lib/storage/getting-started/q/platform/js/

This solution provides the highest level of security by ensuring that each user can only access their own files in Amazon S3 based on their identity.

Highest secure => discard A: S3 Event Notifications, it act on notify with event, not blocking risk => discard B: You can't handle by UI or BE code by User ID, but hacker can try to access directly into storage s3 => discard C: I would have said C but that is kind of a custom solution that is both more overhead and more prone to error D ==> The identity prefix in Amazon Cognito allows you to create a unique identity for each user. This prefix can be used as part of the IAM policy to control access at a more granular level.

D is not the best option as IAM policies only apply to actions taken through AWS Management Console, SDKs, and CLI. It does not apply to direct access to S3 from the application. Option B is a good approach, but it requires additional overhead to manage the DynamoDB table. Option A is also a possible solution but only provides limited security as it only validates the upload and download requests, and it does not provide user-level authorization. Option C is the best choice as it allows the developer to implement a custom authentication mechanism in the Lambda function, providing the highest level of security. The authentication mechanism can be integrated with Amazon Cognito user pools and identity pools to authenticate users and ensure that only the owner of the file can upload and download it.

D you benchods. It says cognito in the question motherchods

D is correct answer.

D is the correct answer.

The identity prefix in Amazon Cognito allows you to create a unique identity for each user. This prefix can be used as part of the IAM policy to control access at a more granular level. I would have said C but that is kind of a custom solution that is both more overhead and more prone to error

D is the answer

B can work but does not provide the same level of security as D

I consider between B & D

Answer D is correct

This solution ensures that users can access only their own files in a secure manner.

Answer D: https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-integrating-user-pools-with-identity-pools.html