MLS-C01 Question 344
Single answerYou are a Machine Learning Engineer at a company that uses Amazon S3 to store training datasets for ML models. Your team has an S3 bucket named 'ml-datasets' containing sensitive data. You must ensure that only IAM users within the 'DataScientists' IAM group can access this bucket, and only from the corporate IP address range (203.0.113.0/24). Which S3 bucket policy should you implement?
- A
Grant access to the 'ml-datasets' bucket to all IAM users with a condition that restricts access to the corporate IP address range.
- B
Deny access to the 'ml-datasets' bucket for all except the 'DataScientists' IAM group, without specifying any IP address restrictions.
- C
Grant access to the 'ml-datasets' bucket specifically to the 'DataScientists' IAM group and include a condition that restricts access to requests originating from the corporate IP address range.
- D
Grant public read access to the 'ml-datasets' bucket but restrict write access to the 'DataScientists' IAM group.
Show answer and explanation
Correct answer: C
Explanation
The correct policy must satisfy both conditions: restricting access to the 'DataScientists' IAM group and ensuring that requests originate only from the corporate IP address range. Option 3 achieves this by explicitly granting access to the IAM group while enforcing the IP restriction through a bucket policy condition. Security best practices discourage granting public access to sensitive data or omitting key restrictions like IP address filtering.
- A. Incorrect.
This option misses the requirement to restrict access specifically to the 'DataScientists' IAM group, which would prevent unauthorized users from accessing the S3 bucket.
- B. Incorrect.
This option does not account for the IP address restriction, which is mandatory to ensure secure access from the corporate network only.
- C. Correct.
This option meets both requirements: it grants access solely to the 'DataScientists' IAM group and enforces the condition that requests must originate from the corporate IP address range.
- D. Incorrect.
Granting public read access to the bucket would expose sensitive data to unauthorized users, violating the security requirements.