SAA-C03 Question 6
Select 3A company has an S3 bucket named 'company-data' that stores sensitive customer information. The bucket should only be accessible to employees within the company network via the corporate VPN. The company also wants to ensure that any access attempts from outside the corporate network are denied. How can you design secure access to the S3 bucket to meet these requirements?
- A
Configure an S3 bucket policy to allow access only from specific IP ranges corresponding to the corporate VPN.
- B
Enable S3 Block Public Access on the bucket to prevent unauthorized public access.
- C
Use an IAM role with permissions to access the bucket and assign it to employees' EC2 instances in the corporate network.
- D
Enable AWS CloudTrail logging for the bucket to monitor access attempts and identify unauthorized access.
- E
Use VPC endpoints for S3 to ensure traffic to the bucket stays within the AWS network.
Show answer and explanation
Correct answers: A, B, E
Explanation
To secure access to the S3 bucket, you should use a combination of an S3 bucket policy to allow access only from the corporate VPN's IP ranges, enable S3 Block Public Access to prevent unauthorized public access, and use VPC endpoints for S3 to keep traffic within the AWS network. These measures collectively ensure that the bucket is only accessible to employees within the corporate network and is protected from unauthorized or public access.
- A. Correct.
This is correct. An S3 bucket policy can restrict access to specific IP ranges, such as the IP addresses used by the corporate VPN, ensuring only employees within the network can access the bucket.
- B. Correct.
This is correct. Enabling S3 Block Public Access ensures that no public access can be granted to the bucket, reducing the risk of unauthorized access.
- C. Incorrect.
This is incorrect. Using an IAM role for EC2 instances can help in granting access to resources, but it does not restrict access based on the corporate VPN or IP range, which is a key requirement in this scenario.
- D. Incorrect.
This is incorrect. While enabling AWS CloudTrail logging is a good practice for monitoring access, it does not actively restrict access to the S3 bucket based on the corporate VPN or IP range.
- E. Correct.
This is correct. Using VPC endpoints for S3 ensures that all traffic to the bucket remains within the AWS network, providing an additional layer of security by avoiding exposure to the public internet.