A university research portal lets enrolled students download large private datasets from S3 for one hour, without creating IAM users, while backend jobs need short-lived cross-account access to process uploads. Direct bucket policies are too broad. Which temporary credential mechanism grants scoped time-limited access for both use cases?

S3 presigned URLs delegate time-limited download authority for a specific object without distributing AWS credentials, ideal for browser-based student access, while STS AssumeRole returns short-lived credentials with scoped policies for backend jobs to assume cross-account roles securely. Long-lived access keys increase exposure, complicate revocation, and cannot easily enforce one-hour per-object scoping for external users. Cognito ID tokens authenticate application users but are not themselves S3 object authorizations and still require credential exchange for AWS access. Public read permissions overexpose private datasets and CloudFront signed cookies alone do not provide backend cross-account role credentials. For the exam, pair presigned URLs for direct S3 object sharing with STS for programmatic role assumption, and in practice set the shortest feasible expiration and least-privilege role policies.