SCS-C02 Question 311
Single answerAn organization has several S3 buckets containing sensitive data. The security team wants to ensure that only IAM roles with a specific AWS-managed policy can access one of the buckets. Which type of IAM policy can be used to enforce this requirement?
- A
Identity-based policy attached to an IAM role
- B
Resource-based policy attached to the S3 bucket
- C
Inline policy attached to a group
- D
Session policy passed during the AssumeRole API call
Show answer and explanation
Correct answer: B
Explanation
Resource-based policies allow you to define access directly on an AWS resource, such as an S3 bucket. By attaching a resource-based policy to the bucket, you can specify conditions to allow access only to IAM roles with a specific AWS-managed policy. This approach provides granular control over access to the bucket, ensuring compliance with the security team's requirements.
- A. Incorrect.
Identity-based policies control what actions are allowed for IAM identities, such as roles or users, but they cannot enforce restrictions based on specific policies attached to those identities. Therefore, this is not the correct option.
- B. Correct.
Resource-based policies, such as those applied to S3 buckets, allow you to define access control directly on the resource. You can specify conditions to allow access only to IAM roles with a specific AWS-managed policy. This makes it the correct option.
- C. Incorrect.
Inline policies are attached to identities like users, groups, or roles, but they cannot directly enforce access restrictions on a resource like an S3 bucket. Thus, this is not the correct option.
- D. Incorrect.
Session policies are temporary policies applied during the AssumeRole API call, but they cannot directly enforce restrictions based on AWS-managed policies. Therefore, this is not the correct option.