DEA-C01 Question 459
Single answerYou are designing an AWS Glue ETL pipeline that processes sensitive financial data stored in Amazon S3. The data is tagged with 'environment' (values: 'dev', 'prod') and 'data-classification' (values: 'sensitive', 'public'). Your company requires that only users in the 'Finance' IAM group can access 'prod' data tagged as 'sensitive'. Which is the MOST appropriate authorization method to implement this access control?
- A
Use an IAM role with a policy that explicitly denies access to S3 objects without the 'prod' and 'sensitive' tags.
- B
Use a tag-based access control policy attached to the IAM users in the 'Finance' group to allow access based on the 'environment' and 'data-classification' tags.
- C
Use an attribute-based access control mechanism by enabling S3 Object Lock to restrict access based on object attributes.
- D
Use a role-based access control approach by assigning an IAM role to all 'Finance' group users and attaching a policy that allows access to 'prod' and 'sensitive' S3 objects.
Show answer and explanation
Correct answer: B
Explanation
Tag-based access control is designed for scenarios where access permissions are dependent on resource tags. By attaching a tag-based policy to the IAM users or roles in the 'Finance' group, you can implement fine-grained access control based on the 'environment' and 'data-classification' tags, meeting the requirements of the question. Other methods either lack the required granularity or are not suitable for tag-based access control.
- A. Incorrect.
While this could be implemented, using explicit deny policies for all other tags is not scalable and requires constant updates when new tags or access requirements are added.
- B. Correct.
This is the correct solution as tag-based access control allows you to define fine-grained permissions based on resource tags, and it is highly suitable for this use case where tag values determine access.
- C. Incorrect.
S3 Object Lock is primarily used for data retention and compliance purposes, not for fine-grained attribute-based access control.
- D. Incorrect.
Role-based access control is more generic and does not utilize the tag-based permissions required in this scenario. It also does not address the specific tag-based conditions directly.