SCS-C02 Question 309
Select 2Your organization uses AWS and has implemented an S3 bucket to store sensitive data. The security team wants to ensure that only specific IAM roles can access the bucket, and that access is restricted to read-only operations. Additionally, you need to prevent any unintended permissions from being granted to the bucket through IAM identity-based policies. What is the most appropriate combination of IAM policies to meet these requirements?
- A
Use a resource-based policy on the S3 bucket to explicitly allow access for specific IAM roles and restrict actions to read-only operations.
- B
Use an inline policy attached to the IAM roles to allow read-only access to the S3 bucket.
- C
Use a managed policy to allow read-only access to the S3 bucket and attach it to all IAM roles.
- D
Use a session control policy to define temporary access permissions for the S3 bucket.
- E
Explicitly deny all access to the S3 bucket in the resource-based policy for any principals not explicitly allowed.
Show answer and explanation
Correct answers: A, E
Explanation
To meet the requirements, a resource-based policy provides a direct mechanism to control access at the S3 bucket level, allowing specific IAM roles to perform read-only operations. By combining this with an explicit deny for all other principals, you ensure that unintended access from other IAM entities is prevented. Inline policies, managed policies, and session control policies either do not provide the required granularity or do not address the requirement to restrict access solely to the specified roles.
- A. Correct.
This is correct because resource-based policies allow you to control access at the resource level (in this case, the S3 bucket). By explicitly allowing access for specific IAM roles and restricting actions to read-only, you enforce fine-grained control over the bucket.
- B. Incorrect.
While inline policies can restrict access for specific IAM roles, they do not address the requirement to prevent unintended access from other IAM entities. Resource-based policies are preferred for this use case.
- C. Incorrect.
Managed policies are reusable and scalable, but they are not specific to the S3 bucket in question. This option would not prevent unintended access from other IAM entities.
- D. Incorrect.
Session control policies are used to define temporary permissions during an assumed role or session, but they do not provide the persistent access controls required for this scenario.
- E. Correct.
This is correct because explicitly denying access to all other principals in the resource-based policy ensures that no unintended permissions can be granted to the S3 bucket, adding an additional layer of security.