DEA-C01 Question 413
Select 3You are designing a data lake on Amazon S3 to store sensitive customer data. Your organization requires that all data be encrypted at rest and that access to the data be restricted to specific IAM roles. Additionally, you need to ensure that no data is accidentally exposed due to overly permissive bucket policies. What combination of steps should you take to meet these requirements?
- A
Enable default encryption on the S3 bucket using an AWS Key Management Service (KMS) key.
- B
Use Amazon S3 Block Public Access to restrict public access to the bucket.
- C
Attach an S3 bucket policy allowing access to all authenticated AWS users.
- D
Use IAM policies to grant access to the bucket only to specific IAM roles.
- E
Enable S3 Versioning to maintain a history of object changes.
Show answer and explanation
Correct answers: A, B, D
Explanation
To secure sensitive customer data, you need to ensure encryption at rest, restrict access to specific IAM roles, and prevent accidental exposure due to misconfigurations. Enabling default encryption with an AWS KMS key ensures data is encrypted at rest. Using S3 Block Public Access helps prevent accidental public exposure. Finally, using IAM policies to restrict access to specific IAM roles ensures only authorized entities can access the data. These steps collectively satisfy the requirements for data security and governance.
- A. Correct.
Correct. Enabling default encryption with an AWS KMS key ensures that all objects stored in the bucket are encrypted at rest, meeting the requirement for encryption.
- B. Correct.
Correct. Amazon S3 Block Public Access prevents any public access to the bucket, helping to ensure that data is not accidentally exposed.
- C. Incorrect.
Incorrect. Allowing access to all authenticated AWS users would make the data available to any user with AWS credentials, which violates the requirement to restrict access to specific IAM roles.
- D. Correct.
Correct. Using IAM policies to grant access to specific IAM roles ensures that only authorized identities can access the data.
- E. Incorrect.
Incorrect. While enabling S3 Versioning is a good practice for data protection and recovery, it does not address encryption or access control requirements directly.