SCS-C02 Question 239
Select 2A company uses an Amazon S3 bucket to store sensitive financial data. The Security team has mandated that data in this bucket should be encrypted at rest and access to the bucket must be restricted to specific IAM roles within the company. An auditor has flagged that the bucket policy allows access to 'aws:PrincipalOrgID', which grants access to all accounts within the organization. What steps should you take to address the auditor's concern?
- A
Use AWS Key Management Service (KMS) to enable server-side encryption for the S3 bucket.
- B
Modify the bucket policy to explicitly deny access to 'aws:PrincipalOrgID'.
- C
Use an S3 bucket ACL to control access instead of the bucket policy.
- D
Replace the 'aws:PrincipalOrgID' condition with specific IAM roles that need access.
- E
Enable S3 default encryption using AES-256 and leave the bucket policy unchanged.
Show answer and explanation
Correct answers: B, D
Explanation
The primary issue flagged by the auditor is related to access control, specifically the use of 'aws:PrincipalOrgID' in the bucket policy, which grants access to all accounts in the organization. To address this, you should modify the bucket policy to explicitly deny access to 'aws:PrincipalOrgID' and replace it with specific IAM roles that require access. While encryption is important for data security, it does not resolve the access control issue highlighted in this scenario.
- A. Incorrect.
While enabling server-side encryption with AWS KMS is a best practice for securing data at rest, it does not address the issue of overly permissive access granted by 'aws:PrincipalOrgID' in the bucket policy.
- B. Correct.
Explicitly denying access to 'aws:PrincipalOrgID' ensures that access is not granted to all accounts within the organization, which directly addresses the auditor's concern.
- C. Incorrect.
Using an S3 bucket ACL is not recommended for fine-grained access control as bucket policies provide a more flexible and scalable solution for managing permissions.
- D. Correct.
Replacing the 'aws:PrincipalOrgID' condition with specific IAM roles aligns access control with the security team's requirement to restrict access to specific roles.
- E. Incorrect.
Enabling S3 default encryption is good for ensuring data encryption at rest, but it does not address the access control issue flagged by the auditor.