DEA-C01 Question 461
Select 3A data engineering team is setting up an Amazon S3 bucket to store sensitive customer data. They want to ensure compliance with the principle of least privilege while granting access to a specific team of analysts to query the data using Amazon Athena. Which of the following actions should the team take to follow the principle of least privilege?
- A
Create an IAM policy granting 's3:*' permissions on the bucket and attach it to the analysts' IAM group.
- B
Create an IAM policy granting only 's3:GetObject' and 's3:ListBucket' permissions for the bucket and attach it to the analysts’ IAM group.
- C
Use an S3 bucket policy to allow only specific analysts to access the bucket, and define the specific actions they are allowed to perform.
- D
Enable public access to the bucket so that analysts can access the data without requiring additional IAM policies.
- E
Create a specific IAM role with minimal permissions required for querying the bucket and allow analysts to assume the role when needed.
Show answer and explanation
Correct answers: B, C, E
Explanation
The principle of least privilege ensures that users or roles are only granted the permissions necessary to perform their tasks, minimizing security risks. In this scenario, granting minimal permissions ('s3:GetObject' and 's3:ListBucket'), using specific bucket policies, and leveraging IAM roles for temporary access ensure compliance with this principle while maintaining security for sensitive customer data.
- A. Incorrect.
Granting 's3:*' permissions violates the principle of least privilege because it provides excessive access beyond what is required.
- B. Correct.
Granting only 's3:GetObject' and 's3:ListBucket' permissions aligns with the principle of least privilege, as it restricts access to only the required actions.
- C. Correct.
Using an S3 bucket policy to explicitly allow only specific analysts and actions ensures that access is narrowly scoped, adhering to the principle of least privilege.
- D. Incorrect.
Enabling public access to the bucket violates security best practices and the principle of least privilege by allowing unrestricted access to sensitive data.
- E. Correct.
Creating and using a specific IAM role with minimal, necessary permissions is a best practice for implementing the principle of least privilege while securely granting access.