DEA-C01 Question 469
Single answerA data engineering team is designing an Amazon S3-based data lake for an organization that has strict security and compliance requirements. The organization wants to ensure that only specific teams have access to specific folders within the S3 bucket based on their roles. For example, the 'Data Science' team should only have access to the 'data-science/' folder, and the 'Analytics' team should only have access to the 'analytics/' folder. What is the MOST appropriate way to enforce this access control?
- A
Use S3 bucket policies to define specific role-based access for each folder.
- B
Create IAM roles for each team, attach policies to the roles granting folder-level access, and have team members assume their respective roles.
- C
Enable S3 Block Public Access and rely on default IAM permissions for folder-level access control.
- D
Use Amazon Macie to automatically assign permissions to folders based on data classification.
Show answer and explanation
Correct answer: B
Explanation
The best approach to enforce role-based access control in this scenario is to create IAM roles for each team and attach policies granting specific access to the corresponding S3 folder. This method ensures that access is managed securely and aligns with AWS best practices. While S3 bucket policies can be used, they are less flexible and harder to manage for team-specific permissions. Other options, like enabling S3 Block Public Access or using Amazon Macie, do not address the specific requirements of role-based access control.
- A. Incorrect.
S3 bucket policies are effective for bucket-wide or prefix-based access control, but managing access control for multiple teams using bucket policies alone can become complex and error-prone. It is better to use IAM roles for role-based access control in this scenario.
- B. Correct.
Creating IAM roles for each team and attaching folder-specific policies to the roles is the most appropriate solution. It aligns with best practices for role-based access control and ensures only authorized users can access their designated folders.
- C. Incorrect.
Enabling S3 Block Public Access is good for blocking public access to the bucket, but it does not address role-based access control for different teams.
- D. Incorrect.
Amazon Macie is a data classification and security service. It does not provide access control mechanisms or assign permissions to folders.