CLF-C02 Question 107
Select 2Your company wants to grant developers access to an S3 bucket for reading logs, while ensuring they cannot accidentally delete or modify the logs. You are tasked with setting up permissions following the principle of least privilege. Which actions should you take to achieve this?
- A
Create an IAM user group for developers and attach a managed policy that grants 'S3:ListBucket' and 'S3:GetObject' permissions.
- B
Attach the 'AmazonS3FullAccess' managed policy to the developers' IAM user group.
- C
Create a custom policy that allows 'S3:ListBucket' and 'S3:GetObject', and explicitly denies 'S3:DeleteObject' and 'S3:PutObject'. Attach it to the developers' IAM user group.
- D
Grant public access to the S3 bucket to allow developers to read logs without authentication.
- E
Use an inline policy attached to each developer's IAM user to grant 'S3:GetObject' and 'S3:ListBucket' permissions only for the specific bucket.
Show answer and explanation
Correct answers: A, C
Explanation
To comply with the principle of least privilege, you should only grant the minimum permissions necessary for developers to perform their tasks. Using group-level managed or custom policies with fine-grained permissions, such as allowing 'S3:GetObject' and 'S3:ListBucket' while denying 'S3:DeleteObject' and 'S3:PutObject', ensures developers have access to read logs without compromising security or allowing unintended actions. Avoid granting overly permissive policies or public access.
- A. Correct.
Correct. This grants the necessary permissions ('S3:ListBucket' and 'S3:GetObject') for developers to read logs without over-provisioning access.
- B. Incorrect.
Incorrect. The 'AmazonS3FullAccess' managed policy grants full access to all S3 actions, violating the principle of least privilege.
- C. Correct.
Correct. Creating a custom policy with explicit 'Allow' and 'Deny' statements ensures developers only have the required permissions, following the principle of least privilege.
- D. Incorrect.
Incorrect. Granting public access to the bucket is a security risk and violates the principle of least privilege.
- E. Incorrect.
Incorrect. While inline policies can work, managing them at the individual user level is less scalable and harder to audit compared to using group-level policies.