When another party acts on your behalf, you need conditions that prove who it is acting for. These notes cover the confused deputy problem and the controls AWS documents for it, plus how a presigned URL inherits the permissions and lifetime of whoever created it.
The ExternalId in a role's trust policy prevents the confused deputy problem with third parties. The third party generates and controls it (unique per customer), not you: that is why you receive it from them instead of inventing it.
Official source: docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html
When you grant access to a service principal (e.g. cloudtrail.amazonaws.com), use aws:SourceArn or aws:SourceAccount in the resource policy. Without that condition, another account that knows the bucket name could write to it.
Official source: docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html
A resource control policy (RCP) can enforce confused deputy controls centrally with aws:SourceOrgID and aws:SourceOrgPaths, without editing every resource policy. A matching Allow is still needed in the resource policy.
Official source: docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html
A presigned URL uses the credentials and permissions of whoever generated it and works as a bearer token. If it was created with temporary credentials (role, STS), it expires when they expire, even if the URL has a later expiration.
Official source: docs.aws.amazon.com/AmazonS3/latest/userguide/using-presigned-url.html
A presigned URL lasts from 1 minute to 12 hours from the console, and up to 7 days with the CLI/SDK using IAM user credentials and SigV4. You can restrict it with the s3:signatureAge condition or by limiting the network path (aws:SourceIp, aws:SourceVpce).
Official source: docs.aws.amazon.com/AmazonS3/latest/userguide/using-presigned-url.html
Answer practice questions, then review your mistakes with spaced repetition.