DVA-C02 Question 147
Select 2You are developing a photo-sharing application that stores user-uploaded images in an Amazon S3 bucket. The application needs to support two types of users: 'Viewers' who can only read files and 'Contributors' who can upload and delete files. You decide to use ACLs (Access Control Lists) to manage permissions. What is the correct way to configure ACLs to meet the application's requirements?
- A
Grant 'READ' permission to the Viewer group and 'FULL_CONTROL' permission to the Contributor group using bucket ACLs.
- B
Grant 'READ' permission to individual Viewer users and 'WRITE' permission to individual Contributor users on object ACLs.
- C
Grant 'READ' permission to the Viewer group on the bucket ACL and use IAM roles for Contributor permissions.
- D
Use object ACLs to grant 'READ' permission to the Viewer group and 'WRITE' and 'DELETE' permissions to the Contributor group.
- E
Use bucket ACLs to grant 'FULL_CONTROL' permission to the Viewer group and 'READ' permission to the Contributor group.
Show answer and explanation
Correct answers: A, D
Explanation
Access Control Lists (ACLs) in Amazon S3 allow permissions to be assigned either at the bucket or object level. For this scenario, bucket ACLs can be used to define user group permissions if managing permissions at the bucket level is sufficient. Alternatively, object ACLs provide more granular control over permissions, allowing specific operations like 'WRITE' and 'DELETE' to be granted to Contributors while restricting Viewers to 'READ' access only. Both approaches are valid depending on the application's permission management strategy.
- A. Correct.
Correct. Bucket ACLs can be used to grant 'READ' permissions to a group of users and 'FULL_CONTROL' to another group. This ensures that Viewers can only read, and Contributors can perform all actions.
- B. Incorrect.
Incorrect. While object ACLs allow granular, per-object permissions, managing individual users is not scalable for group-level permissions. This doesn't align with the requirements.
- C. Incorrect.
Incorrect. Combining bucket ACLs with IAM roles is not a valid solution for this scenario, as the question specifically asks about using ACLs for both Viewer and Contributor permissions.
- D. Correct.
Correct. Object ACLs can be used to grant specific permissions, such as 'READ' for Viewers and 'WRITE'/'DELETE' for Contributors, fulfilling the application's requirements.
- E. Incorrect.
Incorrect. Granting 'FULL_CONTROL' to the Viewer group and only 'READ' to the Contributor group is the reverse of the required permissions.