SCS-C02 Question 300
Single answerA company has an S3 bucket named 'secure-data-bucket' that stores sensitive data. The Security team has identified that unauthorized users are able to list the objects in the bucket. Upon investigation, you find that the bucket has a bucket policy allowing 's3:ListBucket' and an IAM user named 'TestUser' also has an inline policy attached allowing the same action. What is the BEST way to restrict unauthorized access while ensuring 'TestUser' can still list the bucket contents?
- A
Update the bucket policy to allow access only to 'TestUser' explicitly.
- B
Attach a permission boundary to 'TestUser' denying the 's3:ListBucket' action.
- C
Remove the bucket policy and manage access only through IAM policies.
- D
Add a condition to the bucket policy to restrict access based on IP address.
Show answer and explanation
Correct answer: A
Explanation
The bucket policy is the root cause of unauthorized access because it allows 's3:ListBucket' to a broader audience than intended. To ensure only 'TestUser' can list the bucket contents, you should explicitly allow access to 'TestUser' in the bucket policy. This approach aligns with the principle of least privilege by restricting access at the resource level while maintaining required functionality for authorized users.
- A. Correct.
Updating the bucket policy to explicitly allow access only to 'TestUser' ensures that unauthorized users cannot list the bucket, while still allowing 'TestUser' to access it. Bucket policies take precedence at the resource level.
- B. Incorrect.
Permission boundaries control the maximum permissions an IAM user can have, but they do not override the bucket policy. This would not address the issue of unauthorized access via the bucket policy.
- C. Incorrect.
Removing the bucket policy entirely could cause disruption, as access management would rely solely on IAM policies. This is not the best practice for resource-based access control.
- D. Incorrect.
Adding a condition to the bucket policy restricting access based on IP address could work for limiting unauthorized users, but it may unintentionally block legitimate access for 'TestUser' if their IP doesn't match the condition.