SAA-C03 Question 281
Single answerA company is hosting a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application stores user-uploaded content in an Amazon S3 bucket. The company wants to ensure the S3 bucket is not publicly accessible but still allows the application to upload and retrieve objects. How can this requirement be met?
- A
Create a bucket policy that allows public read and write access to the bucket.
- B
Configure an IAM role for the EC2 instances with permissions to access the S3 bucket.
- C
Use S3 Access Logs to monitor access and ensure no unauthorized users can access the bucket.
- D
Enable block public access settings on the bucket and use a bucket policy to allow access only from the ALB.
Show answer and explanation
Correct answer: B
Explanation
The best way to ensure the S3 bucket is not publicly accessible while still allowing the application to upload and retrieve objects is to use an IAM role attached to the EC2 instances. This role can provide fine-grained access permissions to the S3 bucket without exposing it to the public. Other options either do not meet the requirements or involve unnecessary steps.
- A. Incorrect.
This option would make the bucket publicly accessible, which violates the requirement of not allowing public access.
- B. Correct.
This is the correct approach. By attaching an IAM role to the EC2 instances, they can securely access the S3 bucket without making it publicly accessible.
- C. Incorrect.
While S3 Access Logs are useful for monitoring, they do not restrict access to the bucket or meet the requirement of preventing public access.
- D. Incorrect.
Although blocking public access is a good practice, the ALB itself cannot directly access an S3 bucket. The correct approach is to use IAM roles to grant permissions to the EC2 instances.