SCS-C02 Question 298
Select 2An application running in your AWS environment is failing to access an S3 bucket. The application is using an IAM role for authentication. You need to troubleshoot this issue. Which combination of tools should you use to identify the root cause of the authentication failure?
- A
AWS CloudTrail to review the application's API call history and identify any denied requests
- B
IAM Access Advisor to determine if the IAM role has been used recently
- C
IAM Policy Simulator to evaluate whether the IAM role's permissions allow access to the S3 bucket
- D
AWS Trusted Advisor to check for security best practices related to S3 bucket permissions
- E
Amazon S3 Access Logs to identify any access attempts to the S3 bucket
Show answer and explanation
Correct answers: A, C
Explanation
To troubleshoot authentication issues, you need tools that can help you analyze API call history and evaluate IAM policies. AWS CloudTrail provides detailed logs of API requests and their results, which can reveal if access was denied and why. IAM Policy Simulator allows you to test IAM policy configurations to determine if the permissions are correctly set up for the S3 bucket access. These tools together help identify and resolve authentication problems effectively.
- A. Correct.
AWS CloudTrail is useful for reviewing API call history and identifying denied requests, which can help pinpoint authentication issues.
- B. Incorrect.
IAM Access Advisor shows the recent usage of IAM roles or permissions, but it does not provide detailed information on API calls or access issues.
- C. Correct.
IAM Policy Simulator can evaluate whether the IAM role's permissions allow access to the S3 bucket, making it essential for troubleshooting authentication issues.
- D. Incorrect.
AWS Trusted Advisor provides recommendations for security and cost optimization but does not directly assist in diagnosing authentication issues.
- E. Incorrect.
Amazon S3 Access Logs can show access attempts, but they do not provide detailed information on IAM policy evaluation or authentication failures.