SCS-C02 Question 314
Select 4An organization is using an S3 bucket to store sensitive customer data. They need to implement a bucket policy that ensures only users from their specific AWS account can perform 's3:GetObject' and 's3:PutObject' actions. The policy should also enforce that requests must come from a specific VPC endpoint. Which of the following conditions and policy components should you include to achieve this?
- A
Use 'Principal' to specify the AWS account ID of the organization.
- B
Use 'Action' to specify 's3:GetObject' and 's3:PutObject'.
- C
Use 'Condition' with the key 'aws:SourceVpce' and the value of the VPC endpoint ID.
- D
Use 'Resource' to specify the ARN of the S3 bucket.
- E
Use 'Condition' with the key 'aws:SecureTransport' to enforce HTTPS-only access.
Show answer and explanation
Correct answers: A, B, C, D
Explanation
To implement the required restrictions, the policy must include all relevant components: 'Principal' to limit access to the organization's AWS account, 'Action' to specify the allowed operations ('s3:GetObject' and 's3:PutObject'), 'Condition' to enforce requests originating from the specific VPC endpoint ('aws:SourceVpce'), and 'Resource' to specify the S3 bucket ARN. While 'aws:SecureTransport' is a valid condition key, it is not directly relevant to the scenario described, which specifically focuses on VPC endpoint and account-level restrictions.
- A. Correct.
Correct: The 'Principal' element specifies the AWS account or IAM users who are allowed or denied permissions. To restrict access to users within the organization's AWS account, you must specify the account ID in the 'Principal' field.
- B. Correct.
Correct: The 'Action' element specifies which operations are allowed or denied. Here, you must explicitly allow 's3:GetObject' and 's3:PutObject' to permit reading and writing to the S3 bucket.
- C. Correct.
Correct: The 'Condition' element allows granular restrictions. Using the 'aws:SourceVpce' key ensures that requests originate from a specific VPC endpoint, adding an additional layer of security.
- D. Correct.
Correct: The 'Resource' element defines the specific AWS resource being controlled by the policy. Specifying the ARN of the S3 bucket ensures the policy applies only to that bucket.
- E. Incorrect.
Incorrect: While 'aws:SecureTransport' is a useful condition key to enforce HTTPS-only access, it is not required in this scenario since the question focuses on restricting access to the AWS account and VPC endpoint.