Question

A media company stores private video files in an S3 bucket that has Block Public Access enabled. A mobile application needs to allow authenticated end users to download a specific video file for a limited time (15 minutes) without granting them long-term AWS credentials or making the object public. What is the MOST appropriate way to provide this temporary access?

Accepted Answer

Generate an S3 presigned URL for the object using credentials that have s3:GetObject permission, setting an expiration of 15 minutes.

Answer

Attach a bucket policy that allows s3:GetObject to the principal "*" and rely on the application to stop sharing the link after 15 minutes.

Answer

Disable Block Public Access on the bucket and make only the requested object public through an object ACL.

Answer

Create an IAM user for each end user with s3:GetObject permission and rotate the access keys every 15 minutes.