DEA-C01 Question 445
Select 2You are a data engineer managing an Amazon S3 bucket that stores sensitive customer data. Multiple teams in your organization need access to the bucket for different purposes. The Finance team requires read-only access to the bucket, while the Data Science team needs read and write access. Which authorization mechanism(s) should you implement to ensure these access controls are correctly applied?
- A
Create an S3 bucket policy that grants read-only access to the Finance team and read/write access to the Data Science team.
- B
Use IAM roles with specific permissions to grant the required access to each team.
- C
Enable S3 Block Public Access to ensure only authorized users can access the bucket.
- D
Attach the appropriate IAM policies directly to individual users in each team.
- E
Use S3 Access Points to create separate access policies for each team.
Show answer and explanation
Correct answers: A, B
Explanation
To apply authorization mechanisms for this scenario, you should use S3 bucket policies or IAM roles. Bucket policies allow you to define fine-grained access controls at the bucket level, while IAM roles help manage permissions at the team level using the principle of least privilege. These methods are scalable and follow AWS best practices for managing access to sensitive data.
- A. Correct.
Correct: S3 bucket policies are a common way to define access controls for multiple users or services. You can configure a bucket policy to grant read-only and read/write access based on team-specific conditions.
- B. Correct.
Correct: IAM roles with specific permissions are another effective mechanism to control access. By assigning roles to teams, you can enforce the principle of least privilege while allowing controlled access to the S3 bucket.
- C. Incorrect.
Incorrect: While enabling S3 Block Public Access is a good security practice, it does not directly address the specific access requirements for the Finance and Data Science teams.
- D. Incorrect.
Incorrect: Attaching IAM policies directly to individual users is not a scalable or recommended approach for managing access at the team level. It is better to use IAM roles or bucket policies.
- E. Incorrect.
Incorrect: S3 Access Points are useful for managing access to shared datasets at scale, but they are not necessary or optimal for this scenario where bucket policies or IAM roles suffice.