SAA-C03 Question 74
Select 2A company wants to ensure that sensitive data stored in an Amazon S3 bucket is only accessible by specific IAM users and roles. Additionally, the company requires all access requests to be logged for auditing purposes. Which combination of steps should the company implement to meet these requirements?
- A
Enable S3 Server Access Logging on the bucket.
- B
Attach a bucket policy that grants access only to specific IAM users and roles.
- C
Enable S3 Object Lock to prevent accidental deletion of objects.
- D
Enable AWS CloudTrail to log all API requests made to the bucket.
- E
Use Amazon Macie to classify and monitor sensitive data in the bucket.
Show answer and explanation
Correct answers: B, D
Explanation
To meet the requirements, the company needs to restrict access to the sensitive data and ensure all access requests are logged. A bucket policy restricting access to specific IAM users and roles satisfies the access control requirement. Enabling AWS CloudTrail fulfills the logging requirement by capturing all API requests made to the bucket. Other options, such as S3 Server Access Logging and Amazon Macie, are useful for other purposes but do not address both access control and logging requirements in this scenario.
- A. Incorrect.
Enabling S3 Server Access Logging provides information about requests made to the bucket, but does not meet the requirement to restrict access to specific IAM users and roles.
- B. Correct.
Attaching a bucket policy that grants access only to specific IAM users and roles directly addresses the requirement to restrict data access.
- C. Incorrect.
S3 Object Lock is used to protect objects from being deleted or overwritten, but it does not help restrict access or log access requests.
- D. Correct.
Enabling AWS CloudTrail ensures that all API requests, including those to the Amazon S3 bucket, are logged for auditing purposes, which fulfills the requirement for logging access requests.
- E. Incorrect.
Amazon Macie is a data classification and monitoring tool, but it does not restrict access or log access requests, so it is not relevant to this scenario.