A web application lets users download large private reports stored as objects in an Amazon S3 bucket that blocks all public access. The browser must download a report directly from S3 without routing the bytes through the application server, and each download link must stop working after fifteen minutes. How should the developer generate the download access from the backend?
- AMake the report objects public by attaching a bucket policy that allows anonymous GetObject, then return the plain object URL to the browser for the download.
- BGenerate a presigned GetObject URL in the backend with an expiry of fifteen minutes and return that URL to the browser for a direct download. Correct
- CStream the object through the application server by calling GetObject in the backend and piping the bytes to the browser, refreshing the session token every fifteen minutes.
- DCreate an S3 access point for the bucket and hand the access point alias to the browser so the user can request the report object directly.
Why A is wrong: Allowing anonymous GetObject exposes the private reports to anyone with the URL and never expires, which breaks the requirement for private, time-limited access to each object.
Why B is correct: A presigned URL carries the backend caller's temporary signed permission so the browser fetches the private object directly from S3, and the chosen expiry makes the link stop working after fifteen minutes.
Why C is wrong: Proxying the bytes through the application server is exactly what the requirement forbids, since the download is meant to go directly from S3 rather than through the backend.
Why D is wrong: An access point provides a named network entry with its own policy but still requires the caller to hold valid signed credentials, so the alias alone grants no time-limited download to an anonymous browser.