DEA-C01 Question 323
Single answerA company is building a data lake using Amazon S3 to store raw and processed data. They want to enforce fine-grained access control to specific folders within the S3 bucket for different teams while ensuring minimal management overhead. Which solution should the company implement?
- A
Use bucket policies to define access for each team to specific folders.
- B
Use S3 Access Points with specific IAM policies for each team.
- C
Enable S3 Object Lock to restrict access to folders.
- D
Use AWS Glue Data Catalog to manage folder access.
Show answer and explanation
Correct answer: B
Explanation
Using S3 Access Points is the best solution for fine-grained access control in this scenario. It allows the company to create separate access points, each with specific permissions, making it easier to manage access for multiple teams while reducing the complexity of bucket policies.
- A. Incorrect.
Bucket policies can control access at the bucket or folder level, but managing fine-grained access for different teams can become complex and error-prone as the number of teams and folders increases.
- B. Correct.
S3 Access Points allow you to create separate access policies for different applications and teams accessing the same bucket, simplifying fine-grained access management.
- C. Incorrect.
S3 Object Lock is designed to provide write-once-read-many (WORM) protection and does not help with fine-grained access control for specific folders.
- D. Incorrect.
AWS Glue Data Catalog is used for metadata management and querying data, not for managing access to S3 folders.