10-question Solutions Architect diagnostic

Design Secure Architectures

A developer needs to give a third-party SaaS vendor temporary read access to a specific S3 prefix for analytics. The vendor has their own AWS account. What is the most secure approach?

• ACreate an IAM user for the vendor and share the access keys via email
• BMake the prefix publicly readable but obscure the path
• CCreate an IAM role in your account that the vendor's account can assume via sts:AssumeRole, scoped to the prefix and requiring an external ID
• DGenerate a single presigned URL for the prefix that expires in 10 years