SAA-C03 Question 27
Single answerYou are designing a secure architecture for an application on AWS. The application requires access to an Amazon S3 bucket to store and retrieve files. According to AWS security best practices, how should you grant this access to the application?
- A
Attach an AmazonS3FullAccess managed policy directly to the application's IAM role.
- B
Create a custom IAM policy with only the required S3 permissions and attach it to the application's IAM role.
- C
Use the root user to manage access to the S3 bucket for the application.
- D
Make the S3 bucket public so the application can easily access it without requiring IAM permissions.
Show answer and explanation
Correct answer: B
Explanation
The principle of least privilege states that you should grant the minimum permissions necessary for a task. By creating a custom IAM policy with only the required S3 permissions and attaching it to the application's IAM role, you ensure that the application has secure and limited access to the S3 bucket, following AWS security best practices. Options 1, 3, and 4 either violate this principle or introduce significant security risks.
- A. Incorrect.
Attaching the AmazonS3FullAccess managed policy grants unnecessary permissions beyond what the application requires, violating the principle of least privilege.
- B. Correct.
Creating a custom IAM policy with only the required S3 permissions adheres to the principle of least privilege, ensuring the application has access only to what it needs.
- C. Incorrect.
Using the root user to manage access is not recommended because the root account should only be used for critical account-level tasks, and it poses significant security risks.
- D. Incorrect.
Making the S3 bucket public exposes it to everyone on the internet, which is a major security risk and violates AWS best practices.