Apresigned URLallows temporary access to a specific object in an S3 bucket without needing to make the bucket public or creating and managing additional IAM users. The URL is time-limited, and permissions are granted only to the specific object (in this case, the annual report), making it a highly secure and operationally efficient solution.
With a presigned URL, the consultant can access the report for the specified duration (7 days), after which the URL will expire automatically, removing the need for manual intervention to revoke access.
AWS References:
Amazon S3 Presigned URLsexplain how to generate a presigned URL to grant temporary access to S3 objects.
Best Practices for S3 Securityemphasize using presigned URLs for sharing temporary access to S3 objects securely.
Why the other options are incorrect:
A). Public static website: This approach involves making the S3 bucket publicly accessible, which is unnecessary and insecure for sensitive data.
B). Enable public access: Granting public access to the entire bucket, even temporarily, is a security risk and violates best practices.
C). Create an IAM user: Creating an IAM user and managing credentials is unnecessary overhead and less secure compared to a presigned URL for this short-term need.

Security groups are stateful, but they cannot explicitly deny traffic - only allow.
Network ACLs are stateless and support explicit deny rules.To prevent Application A from sending traffic to Application B, configure a deny outbound rule in the network ACL of Application A's subnet to block traffic to Application B's subnet.
"Unlike security groups, network ACLs support both allow and deny rules, enabling you to explicitly block traffic."
- Network ACLs
This is the correct method to block outbound traffic between subnets.

AWS PrivateLink enables private connectivity between VPCs and supported AWS or third-party services without exposing traffic to the public internet. It ensures secure and private communications, making it ideal for connecting internal services to SaaS applications hosted in AWS.
Reference: AWS Documentation - AWS PrivateLink for SaaS Connectivity

Amazon Route 53 supports failover routing policies, which use health checks to route DNS queries to a secondary Region only if the primary endpoint fails. This design ensures only one Region is active for traffic at any given time. This is the recommended architecture for active-passive, multi-Region DR strategies.
AWS Documentation Extract:
"Failover routing lets you route traffic to a primary resource, such as a web server in one Region, and a secondary resource in another Region. If the primary fails, Route 53 can route traffic to the secondary resource automatically." (Source: Amazon Route 53 documentation, Routing Policy Types) A, D: These options do not configure DNS failover for external users.
C: Geolocation routing is for regional distribution, not DR failover.
Reference: AWS Certified Solutions Architect - Official Study Guide, Multi-Region DR and Route 53.

* Option B: A gateway endpoint for S3 allows traffic to S3 without using public IPs and integrates with route tables.
* Option D: Deploying EC2 instances in a private subnet with a NAT gateway enables outbound internet connectivity for other requirements without public IPs.
* Option A: Egress-only internet gateways are for IPv6 traffic and do not work for IPv4 in this context.
* Option C: Interface endpoints are not required for S3 as gateway endpoints are more suitable and cost- effective.
* Option E: A customer gateway is for hybrid connectivity (e.g., on-premises), not suitable for this case.
AWS Documentation References:
* VPC Endpoints
* Amazon S3 Gateway Endpoints