SCS-C02 Question 276
Single answerAn organization wants to allow developers to access an Amazon S3 bucket only from their corporate network and restrict access from anywhere else. The organization uses AWS Identity and Access Management (IAM) for managing permissions. How can this requirement be implemented?
- A
Create an IAM policy that explicitly denies access to the S3 bucket and attach it to the developers' IAM roles.
- B
Create an S3 bucket policy that uses a condition to allow access only if the request originates from the corporate network's IP addresses.
- C
Attach an IAM policy to the developers' IAM roles that allows access to the S3 bucket without any conditions.
- D
Enable S3 Block Public Access settings to restrict access to the bucket.
Show answer and explanation
Correct answer: B
Explanation
The requirement is to allow access to the S3 bucket only from the corporate network. Using an S3 bucket policy with a condition on the source IP addresses is the most effective solution. This approach restricts access based on the IP range associated with the corporate network while still allowing authorized users within that range to access the bucket. IAM policies alone cannot enforce this type of IP-based restriction at the S3 bucket level.
- A. Incorrect.
This option is incorrect because explicitly denying access using IAM policies would block all access, even from the corporate network. It does not fulfill the requirement to allow access selectively.
- B. Correct.
This is the correct answer. S3 bucket policies support conditions, such as IP address restrictions, which can be used to allow access only from the corporate network's IP range.
- C. Incorrect.
This option is incorrect because allowing access without conditions would permit access from anywhere, which violates the requirement to restrict access to the corporate network.
- D. Incorrect.
This option is incorrect because enabling S3 Block Public Access restricts access to the bucket from public entities, but it does not enforce specific IP-based access controls.