SAA-C03 Question 73
Select 3A company stores sensitive financial data in Amazon S3 and needs to ensure that access to this data is restricted to specific IAM roles within the organization. Additionally, the company wants to log all access attempts to this data for auditing purposes. What combination of approaches should the company implement to meet these requirements?
- A
Use an S3 bucket policy to allow access only to specific IAM roles.
- B
Enable S3 Versioning to maintain multiple versions of the data for auditing purposes.
- C
Enable S3 Server Access Logging to track all access requests to the bucket.
- D
Configure AWS CloudTrail to log all API calls made to the bucket.
- E
Use Amazon Macie to block unauthorized access to sensitive data.
Show answer and explanation
Correct answers: A, C, D
Explanation
To meet the requirements, the company should implement an S3 bucket policy to restrict access to specific IAM roles, use S3 Server Access Logging to track all access requests, and enable AWS CloudTrail to log API calls to the bucket. These combined approaches ensure both access control and comprehensive auditing capabilities.
- A. Correct.
Correct. S3 bucket policies can be used to control access to specific IAM roles, ensuring that only authorized roles have access to the sensitive data.
- B. Incorrect.
Incorrect. While S3 Versioning is useful for data recovery and maintaining file history, it is not relevant for restricting access or auditing access attempts.
- C. Correct.
Correct. S3 Server Access Logging provides detailed records of the requests made to the bucket, which is essential for auditing purposes.
- D. Correct.
Correct. AWS CloudTrail logs all API calls made to resources, including S3 buckets, enabling the company to track and review access attempts.
- E. Incorrect.
Incorrect. Amazon Macie is a data discovery and classification service that identifies sensitive data but does not actively block unauthorized access.