DEA-C01 Question 474
Select 3You are designing a data pipeline in AWS that processes sensitive customer information stored in Amazon S3. To ensure the data is protected from unauthorized access across services, which of the following methods should you implement?
- A
Use AWS Identity and Access Management (IAM) policies to restrict access to the S3 bucket.
- B
Enable server-side encryption (SSE) with AWS Key Management Service (KMS) for the S3 bucket.
- C
Make the S3 bucket public to simplify service integration.
- D
Use VPC endpoints to restrict access to the S3 bucket within your private network.
- E
Disable logging for the S3 bucket to prevent sensitive data from being logged.
Show answer and explanation
Correct answers: A, B, D
Explanation
To protect sensitive data in Amazon S3, you should implement multiple layers of security. IAM policies control access permissions, server-side encryption ensures data is encrypted at rest, and VPC endpoints restrict data access to private networks. Making the bucket public or disabling logging would reduce the security posture of your data pipeline and should be avoided.
- A. Correct.
IAM policies are a fundamental way to enforce access controls for resources in AWS, including S3 buckets. They allow you to define fine-grained access permissions for users and services.
- B. Correct.
Enabling server-side encryption (SSE) with AWS KMS ensures that data at rest in the S3 bucket is encrypted, providing an additional layer of security.
- C. Incorrect.
Making the S3 bucket public directly exposes your data to the internet, which is a security risk and contradicts the requirement to protect sensitive data.
- D. Correct.
Using VPC endpoints allows secure access to S3 buckets without traversing the public internet, ensuring that the data remains within your private network.
- E. Incorrect.
Disabling logging removes valuable auditing information that can help identify unauthorized access attempts or security issues. Logging should be enabled, not disabled, for sensitive data.