ExamTopics Logo
Mail Usteam@examtopics.com
Menu
Amazon Discussions
exam questions

Exam AWS Certified Solutions Architect - Associate SAA-C03 All Questions

View all questions & answers for the AWS Certified Solutions Architect - Associate SAA-C03 exam
Go to Exam

Exam AWS Certified Solutions Architect - Associate SAA-C03 topic 1 question 907 discussion

Exam question from Amazon's AWS Certified Solutions Architect - Associate SAA-C03
Question #: 907
Topic #: 1
[All AWS Certified Solutions Architect - Associate SAA-C03 Questions]

A company wants to use an AWS CloudFormation stack for its application in a test environment. The company stores the CloudFormation template in an Amazon S3 bucket that blocks public access. The company wants to grant CloudFormation access to the template in the S3 bucket based on specific user requests to create the test environment. The solution must follow security best practices.

Which solution will meet these requirements?

  • A. Create a gateway VPC endpoint for Amazon S3. Configure the CloudFormation stack to use the S3 object URL.
  • B. Create an Amazon API Gateway REST API that has the S3 bucket as the target. Configure the CloudFormation stack to use the API Gateway URL.
  • C. Create a presigned URL for the template object. Configure the CloudFormation stack to use the presigned URL.
  • D. Allow public access to the template object in the S3 bucket. Block the public access after the test environment is created.
Show Suggested Answer Hide Answer
Suggested Answer: C 🗳️
Community vote distribution
C (67%)
A (33%)
by flaviobrf at Aug. 4, 2024, 11:28 p.m.
Disclaimers:
  • - ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
  • - Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Chosen Answer:
This is a voting comment. You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
AnasAWS
Highly Voted 8 months ago
Selected Answer: C
https://docs.aws.amazon.com/AmazonS3/latest/userguide/ShareObjectPreSignedURL.html
upvoted 5 times
blehbleh
6 months, 3 weeks ago
Thank you for posting this.
upvoted 2 times
...
...
Dantecito
Most Recent 1 month, 1 week ago
Selected Answer: C
C. Not the most secure but the only that works. A. Cloudformation is a regional service so is outside the vpc and gateway VPC endpoint only works inside a VPC. B. Doesn't do anything, we need a lambda between api gateway and cloudformation. D. public access is a no.
upvoted 1 times
...
FlyingHawk
2 months, 2 weeks ago
Selected Answer: A
OptionA the gateway endpoint for S3 provides private access to the S3 template, aligns with security best practices, and incurs no additional costs. Option C (presigned URLs) potentially exposing the template to the public internet, even if temporarily. You only use C for the following reasons If you need a quick, temporary solution for granting access to the template. If you are not using a VPC or do not want to set up a VPC endpoint. If the template is not highly sensitive and temporary public exposure is acceptable.
upvoted 2 times
FlyingHawk
2 months, 2 weeks ago
Given the requirement to follow security best practices, Option A (VPC Endpoint) is the better choice. While it requires slightly more effort to set up initially, it provides a secure, private, and persistent solution that aligns with security best practices. If development effort is a critical factor and the company is comfortable with the temporary public exposure of the template, Option C (Presigned URL) can be considered as a quick and easy alternative.
upvoted 1 times
...
...
robotgeek
3 months, 3 weeks ago
Selected Answer: A
The question states "specific user requests" meaning a shared URL does not meet the requirement. BUT with gateway VPC endpoint you can specify custom policies as in the following link https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-access.html
upvoted 2 times
...
pujithacg8
7 months, 3 weeks ago
C, A presigned URL grants temporary access to an S3 object without making it publicly accessible.
upvoted 1 times
...
flaviobrf
8 months ago
Selected Answer: C
For me C is the right answer
upvoted 2 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
exam
Someone Bought Contributor Access for:
PCNSE
Dubai, 1 minute ago