Scope a pre-signed URL

A vendor has emailed you asking for one file from the reports bucket: a single invoice, today. The vendor has no AWS account, and issuing credentials would hand over far more than one file, for far longer than one day.

A pre-signed URL is the alternative: a SigV4 signature you calculate once and hand over, carrying one object, one action, and a clock. The link below was scoped to exactly what the vendor asked for. Read its query parameters and what each one fixes.

You send the scoped link to the vendor.

Which statement describes what they can do with it?

This exercise is part of the course

Using AWS Security for Developers

View Course

Hands-on interactive exercise

Turn theory into action with one of our interactive exercises

Start Exercise

This exercise is part of the course

Using AWS Security for Developers

IntermediateSkill Level

0.0+

0 reviews

Start Course for Free

In this chapter, you'll build the mental model that keeps real AWS workloads safe: separating the actor from the principal AWS actually evaluates. You'll then learn to read an IAM policy the way AWS does, working out whether a call is allowed, denied, or silently blocked by nothing at all. Finally, you'll replace long-lived access keys with role assumption, temporary credentials, and pre-signed URLs, the pattern that removes a key from a repository for good.

Exercise 1: Introduction to AWS Security Exercise 2: Identify over-permissioned access paths Exercise 3: Give the function a narrow role Exercise 4: Almost nothing runs as you Exercise 5: IAM policy evaluation and explicit deny Exercise 6: Map policy parts to their purpose Exercise 7: See implicit deny in action Exercise 8: Predict the evaluation outcome Exercise 9: Roles, temporary credentials, and SigV4 Exercise 10: Decide who may assume the role Exercise 11: Scope a pre-signed URL

Current Exercise

Exercise 12: Swap a stored key for a role

In this chapter, you'll draw a clean line between Cognito user pools for sign-in and identity pools for AWS credentials, then verify a token's signature before you trust anything inside it. You'll then map where a permission really comes from among identity policies, resource policies, and the boundaries that cap them, and use that map to choose between IAM, Cognito, and Lambda authorizers for an API Gateway endpoint. Finally, you'll keep secrets out of code and logs, picking the store, the masking, and the rotation habits that survive an incident review.

Exercise 1: User pools, identity pools, and JWTs Exercise 2: Verify a token before you trust it Exercise 3: Decide access from the claims Exercise 4: Pick the right part of Cognito Exercise 5: Identity, resource, and boundary Exercise 6: Choose the policy home Exercise 7: Name the layer that refused Exercise 8: Isolate one tenant Exercise 9: Choosing an API Gateway authorizer Exercise 10: Match the caller to the door Exercise 11: Close the stale window Exercise 12: Stop the confused deputy Exercise 13: Keep secrets out of code and logs Exercise 14: Where the value lives Exercise 15: Sanitize without going blind Exercise 16: Survive the rotation

In this chapter, you'll match encryption mode to requirement: the four ways to encrypt an S3 object, and the one policy line that enforces transit. You'll then work out who really controls a KMS key when a key policy and an IAM policy both have a say, and read CloudTrail closely enough to know when its silence means nobody was logging, not that nothing happened. Finally, you'll run the whole course's checklist against one service you are about to ship, and see where the same identity, secrets, and encryption decisions carry into pipelines and AI agents calling AWS on your behalf.

Exercise 1: Encryption modes and enforcing transit Exercise 2: Encrypted, and still wrong Exercise 3: Match the mode to the requirement Exercise 4: Rank the private half by who holds a copy Exercise 5: Who controls the key Exercise 6: Which gate closed?Exercise 7: Read the denial, name the gate Exercise 8: Choose the key, then live with it Exercise 9: Reading AWS receipts Exercise 10: Under whose authority Exercise 11: What the trail will and will not hold Exercise 12: Right-size a role from its own activity Exercise 13: Shipping it safely Exercise 14: Ticked, and still open Exercise 15: The trigger that already fired Exercise 16: Ask the same three of a non-human caller Exercise 17: Congratulations