DVA-C02 Question 146
Single answerYou are developing a web application that allows users to upload and share images. The images are stored in an Amazon S3 bucket. To control access, you need to implement fine-grained permissions so that only the owner of an image can read, update, or delete their own files, while allowing public read access to specific images. How can you achieve this using S3 Access Control Lists (ACLs)?
- A
Set the bucket ACL to 'public-read' and rely on IAM policies to restrict access to individual files.
- B
Use object-level ACLs to grant public-read access to specific images and private access to the owners for their files.
- C
Configure a bucket policy to enforce owner-only access and public-read access for specific objects.
- D
Set the default ACL for all objects in the bucket to 'bucket-owner-full-control' and configure public-read for specific images using object-level ACLs.
Show answer and explanation
Correct answer: B
Explanation
Amazon S3 Access Control Lists (ACLs) allow you to control access at the object level. By using object-level ACLs, you can grant 'public-read' access to specific images while ensuring that other objects are private and only accessible to their owners. This approach satisfies the requirement for fine-grained permissions using ACLs.
- A. Incorrect.
This option incorrectly applies a bucket-wide ACL, which would make all objects in the bucket publicly readable. ACLs apply at the bucket or object level, and IAM policies cannot override ACLs for access control.
- B. Correct.
This is the correct answer. Object-level ACLs can be used to define fine-grained permissions. You can set specific objects to 'public-read' for public access and ensure private access for the owners.
- C. Incorrect.
This option refers to bucket policies, not ACLs. While bucket policies can enforce access controls, the question specifically asks about implementing authorization using ACLs.
- D. Incorrect.
This option would incorrectly apply 'bucket-owner-full-control' as the default ACL for all objects, which might conflict with the requirement for public-read access on specific objects.