DVA-C02 Question 148
Single answerYou are developing a photo-sharing application where users can upload and share images. The images are stored in an S3 bucket, and you need to ensure that only the image owner can read or write their own images while allowing public read-only access to specific images that the owner marks as 'public'. Which of the following is the best approach to implement this requirement?
- A
Use S3 bucket policies to define access for each individual object.
- B
Use S3 Access Control Lists (ACLs) to set object-level permissions for each image.
- C
Use IAM roles to define access permissions at the user level.
- D
Use S3 event notifications to control access dynamically at runtime.
Show answer and explanation
Correct answer: B
Explanation
The requirement specifies that access control should be applied at the object level, allowing only the owner to read or write their own images while enabling public read access for specific images. S3 Access Control Lists (ACLs) are designed for this purpose, as they allow you to define fine-grained permissions for individual objects. Other options, like bucket policies and IAM roles, operate at a broader level and do not meet the specific object-level requirements of this scenario.
- A. Incorrect.
Bucket policies apply at the bucket level and are not designed to handle fine-grained, object-level permissions for individual images. This approach is not suitable for the scenario.
- B. Correct.
S3 Access Control Lists (ACLs) allow you to set object-level permissions, making it possible to define different access rules for individual images, such as owner-only access or public read access. This is the correct approach for the given requirement.
- C. Incorrect.
IAM roles are used to manage permissions at the user or application level, not at the object level within an S3 bucket. This does not address the need for object-level access control.
- D. Incorrect.
S3 event notifications are used to trigger actions (e.g., Lambda functions) based on S3 events like object creation or deletion. They are not suitable for managing access permissions.