DEA-C01 Question 462
Single answerYou are a Data Engineer managing an AWS environment for a large organization. Your team needs access to an Amazon S3 bucket that stores raw data for analytics processing. According to the principle of least privilege, what is the best approach to granting access?
- A
Grant full access to the S3 bucket to all users in your team.
- B
Create an IAM policy that grants only the required read and write permissions for the S3 bucket and attach it to a specific IAM role.
- C
Use the root user credentials to access the S3 bucket and share it with the team.
- D
Create an IAM policy that grants access to all S3 buckets in your AWS account and attach it to the team's IAM group.
Show answer and explanation
Correct answer: B
Explanation
The principle of least privilege ensures that users are granted only the permissions necessary to perform their tasks. By creating a narrowly scoped IAM policy that provides access only to the specific S3 bucket and the required permissions, you minimize the risk of unauthorized actions or data exposure while maintaining security best practices.
- A. Incorrect.
Granting full access to the S3 bucket to all users in your team violates the principle of least privilege as it provides more permissions than what is necessary.
- B. Correct.
Creating an IAM policy that grants only the required read and write permissions for the S3 bucket and attaching it to a specific IAM role adheres to the principle of least privilege by restricting access to only what is needed.
- C. Incorrect.
Using the root user credentials is a security risk and violates the principle of least privilege. The root user should only be used for account-level administrative tasks and not for routine access.
- D. Incorrect.
Granting access to all S3 buckets in the AWS account provides excessive permissions, violating the principle of least privilege, as it exceeds the scope of what is required for the task.