A company needs to share reference documents stored in an S3 bucket it owns with external workshop attendees for 7 days. What is the most secure way to share those documents for that period?

Generating S3 presigned URLs is the most secure and practical solution. Presigned URLs grant temporary access to specific S3 objects without requiring AWS credentials or creating new user accounts. By setting an expiration of 7 days, access automatically revokes, aligning with the requirement. Moving documents to Amazon WorkDocs is unnecessarily complex and introduces a new service for a simple sharing task. Creating temporary IAM users and sharing access keys is insecure; distributing credentials increases the risk of compromise and requires manual credential management. Sharing an IAM role's ARN is insufficient; external users would still need to assume the role, which typically requires their own AWS accounts and credentials, making it overly complicated for workshop attendees.