IAM Quiz
Your organization AWS Setup has an AWS S3 bucket which stores confidential documents which can be only downloaded by users authenticated and authorized via your application. You do not want to create IAM users for each of these users and as a best practice you have decided to generate AWS STS Federated User temporary credentials each time when a download request is made and then use the credentials to generate presigned URL and redirect user for download. However, when user is trying to access the presigned URL, they are getting Access Denied Error. What could be the reason?
A. AWS STS service must be given access in S3 bucket ACL.
B. IAM User used to generate Federated User credentials does not have access on S3 bucket.
C. IAM Role used to generate Federated User credentials does not have access on S3 bucket.
D. Your application must be whitelisted in AWS STS service to perform FederatedUser action.
B. IAM User used to generate Federated User credentials does not have access on S3 bucket. Returns a set of temporary security credentials (consisting of an access key ID, a secret access key, and a security token) for a federated user. A typical use is in a proxy application that gets temporary security credentials on behalf of distributed applications inside a corporate network. You must call the GetFederationToken operation using the long-term security credentials of an IAM user. As a result, this call is appropriate in contexts where those credentials can be safely stored, usually in a server-based application. For a comparison of GetFederationToken with the other API operations that produce temporary credentials https://docs.aws.amazon.com/STS/latest/APIReference/API_GetFederationToken.html
