SCS-C02 Question 310
Single answerYour organization is designing an access control strategy for an S3 bucket that stores sensitive financial data. The goal is to allow only IAM users in a specific department to access the bucket, while also ensuring that access can be audited and managed centrally. Which IAM policy approach would best meet these requirements?
- A
Use an identity-based policy attached to the IAM users in the department and explicitly grant S3 bucket access.
- B
Attach an inline policy directly to the S3 bucket and define permissions explicitly.
- C
Attach a resource-based policy to the S3 bucket to allow access for the IAM roles used by the department.
- D
Use a managed policy applied to a group containing all the department's IAM users, and grant S3 bucket access via the managed policy.
Show answer and explanation
Correct answer: D
Explanation
Managed policies provide the best approach for centralized management and auditing of permissions. By attaching a managed policy to a group of IAM users in the department, you can easily control and audit access to the S3 bucket without having to individually manage identity-based or inline policies. Resource-based policies could work but are less suitable for centralized user-based management.
- A. Incorrect.
Identity-based policies attached to individual IAM users can grant permissions but are harder to manage and audit at scale. This is not the best option for centralized management.
- B. Incorrect.
Inline policies are directly attached to specific resources or entities and are not ideal for centralized management or reuse across multiple users or groups.
- C. Incorrect.
Resource-based policies are attached to resources (like S3 buckets) and can allow cross-account access. While they can work for this scenario, they are less effective for centralized control and auditing compared to managed policies.
- D. Correct.
Managed policies allow centralized management of permissions, are reusable, and can be applied to groups of users. In this case, assigning a managed policy to a group of department IAM users is the most scalable and auditable solution.