DEA-C01 Question 446
Select 3You are designing a data lake architecture on AWS that stores sensitive customer data in Amazon S3. Your organization requires that only specific IAM roles associated with your ETL jobs and data analysts should have access to the data. Additionally, the solution must ensure that unauthorized access is prevented and logging is enabled for audit purposes. Which combination of actions should you take to meet these requirements?
- A
Use S3 bucket policies to grant access to specific IAM roles and restrict access for others.
- B
Enable AWS CloudTrail logging for S3 bucket access to monitor all API requests.
- C
Use Amazon Macie to automatically grant access to trusted users when sensitive data is detected.
- D
Apply IAM policies to explicitly deny access to unauthorized users and allow access to specific IAM roles.
- E
Use an S3 Access Point to define a policy granting limited access to the S3 bucket.
Show answer and explanation
Correct answers: A, B, D
Explanation
To meet the requirements of granting access to specific IAM roles, preventing unauthorized access, and enabling audit logging, a combination of S3 bucket policies, IAM policies, and AWS CloudTrail logging should be used. S3 bucket policies and IAM policies provide granular access control, while AWS CloudTrail ensures that all access attempts are logged for auditing purposes. Amazon Macie and S3 Access Points, while useful in other scenarios, are not directly relevant to the stated requirements for this use case.
- A. Correct.
This is correct because S3 bucket policies can be used to grant fine-grained access to specific IAM roles while denying access to others.
- B. Correct.
This is correct because enabling AWS CloudTrail logging for S3 provides an audit trail of all API activity, which is critical for compliance and monitoring unauthorized access attempts.
- C. Incorrect.
This is incorrect because Amazon Macie is used for data discovery and classification, not for granting or managing access to users.
- D. Correct.
This is correct because IAM policies can be crafted to explicitly deny access to unauthorized users while allowing access to authorized roles, ensuring tight control over data access.
- E. Incorrect.
This is incorrect because while S3 Access Points enable easier management of data access, they are not inherently required for meeting the stated requirements in this scenario.