SAA-C03 Question 26
Select 3Your company recently hired a new team of developers who need access to an Amazon S3 bucket to store application logs. The logs contain sensitive customer data, so you must ensure the principle of least privilege is followed while granting access. Which steps should you take to securely provide access to the developers?
- A
Create an IAM group for the developers, attach a policy granting access to only the specific S3 bucket, and add the developers to the group.
- B
Attach an AmazonS3FullAccess policy directly to each developer's IAM user for simplicity.
- C
Use an S3 bucket policy to grant access to the developers based on their IAM roles and restrict access to specific actions like 's3:PutObject' and 's3:GetObject'.
- D
Enable multi-factor authentication (MFA) for all developer IAM users and require MFA for S3 bucket access.
- E
Grant public read/write access to the S3 bucket to ensure the developers can access it without additional permissions.
Show answer and explanation
Correct answers: A, C, D
Explanation
To follow the principle of least privilege, you should grant only the minimum permissions necessary for developers to perform their tasks. Using an IAM group with specific policies and bucket policies ensures permissions are controlled and limited to the required actions. Additionally, enabling MFA adds an extra layer of security when accessing the sensitive data. Avoid granting overly broad permissions, such as AmazonS3FullAccess, or public access, as these pose significant security risks.
- A. Correct.
Correct. Creating an IAM group and attaching a policy that provides access only to the specific S3 bucket enforces least privilege and simplifies permissions management.
- B. Incorrect.
Incorrect. Attaching AmazonS3FullAccess directly to each user grants unnecessary permissions beyond what the developers need, violating the principle of least privilege.
- C. Correct.
Correct. Using an S3 bucket policy to restrict access to specific actions and roles ensures that developers only have the necessary permissions, aligning with security best practices.
- D. Correct.
Correct. Enabling MFA adds an extra layer of security, which is crucial when dealing with sensitive customer data, and requiring MFA for access strengthens compliance with security best practices.
- E. Incorrect.
Incorrect. Granting public access to the bucket is a major security risk and violates the principle of least privilege, as it exposes sensitive data to unauthorized users.