SCS-C02 Question 368
Select 2An organization is using an Amazon S3 bucket to store sensitive financial reports. They want to ensure that only specific IAM roles within their AWS account can access the bucket. Additionally, they require that access is only allowed when requests originate from their corporate VPN IP address range. Which configuration in the S3 bucket policy will meet these requirements?
- A
Use a resource policy with a condition that restricts access by specifying the 'aws:SourceIp' condition key for the corporate VPN IP range.
- B
Attach an IAM policy directly to the IAM roles that specifies the allowed IP range using the 'aws:SourceIp' condition key.
- C
Include a resource policy statement that explicitly denies access to all IP addresses except for the corporate VPN range using the 'NotIpAddress' condition key.
- D
Use a resource policy with a condition that checks the 'aws:RequestTag' for a specific tag value to validate VPN-originated requests.
- E
Include a resource policy statement that uses the 'Principal' key to specify the specific IAM roles allowed access and combines it with an 'IpAddress' condition key for the corporate VPN range.
Show answer and explanation
Correct answers: A, E
Explanation
To meet the requirements, the organization must configure an S3 bucket resource policy that restricts access to specific IAM roles and enforces IP-based restrictions for requests originating from their corporate VPN. The 'aws:SourceIp' condition key is used to specify the IP range, while the 'Principal' key ensures that only the specified IAM roles have access. A combination of these mechanisms ensures compliance with the organization's security requirements.
- A. Correct.
Correct. The 'aws:SourceIp' condition key can be used in a resource policy to restrict access based on the originating IP address. This ensures that only requests from the corporate VPN IP range are allowed.
- B. Incorrect.
Incorrect. IAM policies attached to roles cannot enforce resource-level conditions like IP restrictions directly on the S3 bucket. This would provide role-level access, but resource-specific conditions need to be defined in the bucket policy.
- C. Incorrect.
Incorrect. While a 'NotIpAddress' condition key could potentially be used in a deny statement, it is not the optimal or recommended approach. Explicitly allowing access with positive conditions (e.g., 'IpAddress') is preferred for better control and clarity.
- D. Incorrect.
Incorrect. The 'aws:RequestTag' condition key is used for tag-based access control and is irrelevant for restricting access based on IP addresses.
- E. Correct.
Correct. A resource policy can specify allowed IAM principals using the 'Principal' key and combine it with an 'IpAddress' condition key. This approach ensures that only specified IAM roles and IP addresses can access the bucket.