DOP-C02 Question 407
Select 4Your company has recently experienced a security breach where an unauthorized individual accessed sensitive data stored in an Amazon S3 bucket. The root cause analysis revealed that the bucket was publicly accessible, and critical files were neither encrypted nor protected by proper IAM policies. As a DevOps engineer, which actions should you take to mitigate and prevent such incidents in the future?
- A
Enable Amazon S3 Block Public Access at the account and bucket level.
- B
Use IAM roles to grant permissions to applications instead of embedding AWS access keys in your code.
- C
Implement server-side encryption (SSE) for all objects stored in S3.
- D
Disable logging and monitoring for S3 buckets to reduce unnecessary data storage costs.
- E
Regularly audit S3 bucket permissions using AWS Config or AWS Trusted Advisor.
Show answer and explanation
Correct answers: A, B, C, E
Explanation
To mitigate cloud security threats related to Amazon S3, it's crucial to enforce measures such as blocking public access, using IAM roles, enabling encryption, and auditing permissions regularly. These practices collectively reduce the risk of unauthorized access and data breaches. Disabling logging and monitoring, however, is counterproductive as it limits visibility into potential security issues.
- A. Correct.
Enabling S3 Block Public Access helps prevent accidental public exposure of S3 buckets and objects. This is a critical step to secure data.
- B. Correct.
Using IAM roles instead of hardcoding AWS access keys in your code minimizes the risk of keys being exposed or leaked.
- C. Correct.
Server-side encryption ensures that data stored in the S3 bucket is encrypted, providing an additional layer of security.
- D. Incorrect.
Disabling logging and monitoring is not a recommended practice as it reduces visibility into bucket access and potential threats.
- E. Correct.
Regularly auditing S3 bucket permissions helps identify misconfigurations or overly permissive settings, ensuring compliance with best practices.