SCS-C02 Question 16
Select 3Your company has detected unauthorized access to an Amazon S3 bucket containing sensitive data. As part of the incident response process, what are the AWS best practices you should implement immediately to mitigate the situation and prevent further access?
- A
Enable Amazon S3 server access logging for the affected bucket to track access patterns.
- B
Apply an S3 bucket policy to deny access to all users except specific IAM roles or users.
- C
Rotate the credentials of any IAM users or roles that had access to the S3 bucket.
- D
Delete the S3 bucket to immediately stop unauthorized access.
- E
Use AWS Config to create a new rule that prevents public access to any S3 bucket in the account.
Show answer and explanation
Correct answers: A, B, C
Explanation
During an incident involving unauthorized access to an S3 bucket, it is critical to take immediate actions to mitigate risks, gather forensic data, and restore secure access. Enabling Amazon S3 server access logging allows for detailed investigation, applying a restrictive bucket policy prevents further unauthorized access, and rotating IAM credentials addresses the potential compromise. Deleting the bucket or implementing new AWS Config rules may not effectively resolve the issue or could lead to further complications.
- A. Correct.
Enabling Amazon S3 server access logging helps you gather detailed records of requests made to the affected bucket, which is crucial for investigating the root cause and identifying unauthorized access patterns.
- B. Correct.
Applying an S3 bucket policy to deny access to all users except specific IAM entities ensures that only trusted users or roles can access the bucket, mitigating further unauthorized access.
- C. Correct.
Rotating credentials for IAM users or roles that had access to the bucket helps eliminate any compromised credentials that may have been used during the incident.
- D. Incorrect.
Deleting the S3 bucket is not considered a best practice for incident response, as it could lead to permanent data loss and hinder forensic investigation.
- E. Incorrect.
While using AWS Config to prevent public access to S3 buckets is a proactive measure, it does not immediately address the ongoing incident and unauthorized access to the specific bucket.