A logistics platform lets external drivers upload delivery photos directly to S3 for 10 minutes and lets dispatchers query DynamoDB via a web app using corporate SSO, with no long-lived AWS keys on devices. Uploads must be scoped to one driver folder. Which temporary credential mechanism should the developer configure to grant least-privilege short-lived access?
Select an answer to reveal the explanation.
Short Explanation
You wouldn't hand every driver your building's master key when a guest pass that expires will do. That's why you'll use presigned URLs for one-folder uploads that last just minutes, while your dispatchers sign in with SSO federation so there's nothing long-lived to steal.
Full Explanation
The correct pattern matches mechanism to workload: S3 presigned URLs let the backend sign a single PUT constrained to s3://bucket/driver-id/* expiring in 600 seconds, giving external drivers direct short-lived least-privilege upload without an AWS identity or SDK session, while dispatchers obtain short-lived STS credentials via Cognito Identity Pool federated to corporate SAML or IAM Identity Center to query DynamoDB under scoped IAM policies with no stored keys. Vending STS credentials for drivers through Cognito Identity Pool fails on lifetime mechanics because AssumeRole sessions enforce a 15-minute minimum and cannot express the required 10-minute window even when the policy correctly restricts the prefix. Using the Cognito unauthenticated guest role for drivers fails on identity assurance because any anonymous caller can obtain credentials from it, so nothing ties a request to a verified driver and the folder scope cannot rest on a trusted identity. Embedding IAM user access keys in driver apps to mint URLs locally fails on credential persistence because user keys remain valid until explicit rotation or deletion, violating the ban on long-lived device secrets and expanding blast radius if the app is decompiled despite correct 10-minute URL expiry. Exam caveat is to distinguish URL ExpiresIn from STS DurationSeconds and recall service minima rather than assuming any temporary credential can model any TTL. Practical check is to audit the signer role, confirm PutObject allows only the caller prefix, verify the URL fails after 10 minutes, and confirm CloudTrail shows SAML-assumed roles for DynamoDB with no embedded keys.