A mobile app backend needs to let end users upload profile pictures directly to a private S3 bucket without giving them any AWS credentials. A backend service generates a presigned URL for each upload using the AWS SDK with long-term IAM user credentials. What is the maximum expiration time that can be set for this presigned URL?
- 15 minutes
- 1 hour
- 7 days
- There is no maximum; it can be set to expire at any future date
Correct answer: C. 7 days
AWS documentation on presigned URLs states that if you use the AWS CLI or AWS SDKs with long-term credentials such as an IAM user's access keys, the expiration time for a presigned URL can be set as high as 7 days, which is the maximum in this scenario, making the third option correct. Both 15 minutes and 1 hour are valid values someone could choose for a shorter-lived URL, but neither represents the actual ceiling the SDK enforces, so they understate the true maximum and are incorrect as answers to what the maximum is. The fourth option is wrong because presigned URLs generated with long-term credentials are always subject to this 7-day ceiling; attempting to set a longer expiration does not produce an unlimited or indefinitely valid URL. (Note that if temporary, STS-issued credentials are used instead, the presigned URL's validity is further capped by the remaining lifetime of that temporary session, which can be shorter than 7 days, but that is not the case described here.)
Source: AWS S3 documentation: Uploading objects with presigned URLs — 7-day maximum expiration when using the AWS CLI or SDKs