DEA-C01 Question 460
Single answerYou are a data engineer managing an AWS environment for a retail company. The company wants to grant an external analytics team access to specific S3 buckets containing sales data for analysis. Following the principle of least privilege, how should you configure access permissions?
- A
Create an IAM policy that grants full access to all S3 buckets and attach it to a user assigned to the analytics team.
- B
Create an IAM policy that grants read-only access to the specific S3 buckets containing sales data and attach it to a group containing the analytics team.
- C
Share the root user's AWS credentials with the analytics team to allow access to the required buckets.
- D
Create an S3 bucket policy that grants public read access to the specific S3 buckets containing sales data.
Show answer and explanation
Correct answer: B
Explanation
The principle of least privilege involves granting only the permissions needed to complete a specific task. In this scenario, the analytics team only requires read-only access to specific S3 buckets, so creating an IAM policy with restrictive permissions that target those buckets is the correct approach. This ensures secure and controlled access to resources.
- A. Incorrect.
Granting full access to all S3 buckets violates the principle of least privilege because it provides more permissions than necessary for the analytics team to perform their tasks.
- B. Correct.
Granting read-only access to the specific S3 buckets adheres to the principle of least privilege by providing the minimum permissions required for the task.
- C. Incorrect.
Sharing the root user's credentials is a security risk and violates best practices in AWS, including the principle of least privilege.
- D. Incorrect.
Making the S3 buckets publicly accessible exposes sensitive sales data to unauthorized users and violates the principle of least privilege.