A web application serves secure documents stored in a private S3 bucket and must allow only authenticated users to download a specific document for 15 minutes after request. Which approach meets these requirements?

Generating a presigned S3 URL is the most effective solution. This method allows you to grant temporary, time-limited access to private S3 objects without changing bucket policies or making objects publicly accessible. The URL contains security credentials and an expiration time, ensuring that access is revoked automatically after 15 minutes. Copying documents to another bucket is inefficient and adds unnecessary complexity and cost. Using server-side encryption (SSE-KMS) protects data at rest but doesn't control temporary access for downloads. Temporarily updating the bucket policy is cumbersome, error-prone, and difficult to manage at scale, especially for individual document access.