SAA-C03 Question 72
Select 3A company stores sensitive financial data in an Amazon S3 bucket. The data must only be accessed by specific IAM users, and all access requests need to be logged for auditing purposes. Which combination of steps should you take to meet these requirements?
- A
Use an S3 bucket policy to explicitly grant access to the specific IAM users.
- B
Enable Amazon S3 server access logging for the bucket.
- C
Use an IAM role and attach it to the users to allow access to the bucket.
- D
Enable AWS CloudTrail to log all S3 access requests.
- E
Add a public-read ACL to the bucket to ensure easy access for auditors.
Show answer and explanation
Correct answers: A, B, D
Explanation
To meet the requirements of restricting access to specific IAM users and ensuring all access requests are logged, you need to implement an S3 bucket policy to manage access permissions, enable S3 server access logging for detailed bucket access logs, and enable AWS CloudTrail to capture API-level logs for auditing. These steps ensure data governance and security while meeting auditing requirements.
- A. Correct.
Using an S3 bucket policy to explicitly grant access to specific IAM users ensures that only those users have the necessary permissions. This is a core best practice for data governance.
- B. Correct.
Enabling Amazon S3 server access logging ensures that access requests to the bucket are logged, which is crucial for auditing.
- C. Incorrect.
Using an IAM role may not be necessary for this use case since the scenario specifies IAM users. Roles are typically used for applications or services that need temporary access.
- D. Correct.
Enabling AWS CloudTrail provides detailed logging of API calls, including S3 access requests, which is essential for tracking and auditing access.
- E. Incorrect.
Adding a public-read ACL would expose the sensitive financial data to the public, violating the security and governance requirements.