A company moved secure files into a private S3 bucket with no public access and wants a serverless app that lets employees sign in and securely share files with others. Which AWS feature should they use to provide secure, shareable access to those files?

S3 presigned URLs are the correct choice because they provide temporary, time-limited access to specific S3 objects without requiring AWS credentials. This allows the serverless application to generate a URL that employees can use to securely share files with others, even if those users don't have direct AWS access. The URL contains security credentials and a specified expiration date, ensuring controlled access. S3 bucket policies define access permissions at the bucket level, not for individual, temporary sharing. While essential for overall security, they don't facilitate temporary, shareable links. Amazon Cognito user pools manage user authentication, but don't directly grant access to S3 objects. Amazon Cognito identity pools provide temporary AWS credentials for authenticated users, which could be used to access S3, but presigned URLs offer a more direct and secure mechanism for sharing specific files without exposing underlying credentials to the end-user.