DEA-C01 Question 470
Select 3A company is using Amazon S3 to store sensitive customer data. The data needs to be protected from unauthorized access, while ensuring that it is accessible only to specific applications running on Amazon EC2 instances. Which combination of methods should the company use to meet this requirement?
- A
Enable server-side encryption with customer-provided keys (SSE-C) for the S3 bucket.
- B
Use an S3 bucket policy to allow access only from the specific VPC associated with the EC2 instances.
- C
Attach an IAM role to the EC2 instances and grant it permissions to access the S3 bucket.
- D
Enable Amazon Macie to automatically classify and secure the sensitive data in the S3 bucket.
- E
Configure S3 Block Public Access settings to ensure the bucket is not publicly accessible.
Show answer and explanation
Correct answers: B, C, E
Explanation
To protect data from unauthorized access, a combination of methods is required. S3 bucket policies can restrict access to specific VPCs, IAM roles can enforce identity-based permissions for EC2 instances, and S3 Block Public Access settings prevent public exposure. These methods work together to secure the data and ensure it is accessible only by the intended applications.
- A. Incorrect.
While server-side encryption with customer-provided keys (SSE-C) ensures data is encrypted, it does not control access. This option does not address restricting unauthorized access.
- B. Correct.
Using an S3 bucket policy to restrict access to the specific VPC ensures that only resources within the VPC, such as the EC2 instances, can access the bucket. This method helps prevent unauthorized access.
- C. Correct.
Attaching an IAM role with appropriate permissions to the EC2 instances enforces identity-based access control, allowing only the EC2 instances to interact with the S3 bucket securely.
- D. Incorrect.
Amazon Macie helps classify and secure sensitive data, but it is not a direct mechanism for restricting unauthorized access to the bucket or ensuring authorized EC2 instances can access it.
- E. Correct.
Configuring S3 Block Public Access settings ensures that the bucket is not accidentally made publicly accessible, which is a crucial step in protecting the data from unauthorized access.