A photo-sharing app lets authenticated users upload directly to S3 and lets partner analytics assume limited read access for one hour without creating IAM users. Mobile clients cannot hold long-term secrets and uploads must not proxy through backend servers. Which temporary credential mechanism best enables secure delegated access?
Select an answer to reveal the explanation.
Short Explanation
You're giving guests a timed door code instead of your forever key when phones upload directly. You'll use presigned URLs for S3 uploads and STS AssumeRole for that one-hour partner read access.
Full Explanation
Presigned URLs embed SigV4 authentication for a specific S3 object operation with a short expiration, allowing browsers to PUT directly without holding AWS credentials or proxying data, while STS AssumeRole returns temporary access key, secret, and session token scoped by role policy and duration for partners without IAM users. IAM user access keys are long-lived static credentials that violate the no-secrets constraint on mobile devices. Instance profiles supply credentials only to EC2 instances, not to external partner identities. Permanent tokens and root keys create excessive privilege and persistent risk contrary to least privilege. For the exam, match direct S3 delegation to presigned URLs and cross-account or federated delegation to STS. In practice, keep expirations under an hour and scope presigned URLs to exact prefix and content-type.