SCS-C02 Question 369
Single answerYou are tasked with securing an Amazon S3 bucket that stores sensitive financial reports. The bucket must only allow access to users from a specific AWS account. You decide to use a bucket policy to enforce this restriction. Which policy statement will fulfill this requirement?
- A
Allow access to all principals and deny access to everyone else explicitly.
- B
Allow access only to a specific AWS account by specifying the account's AWS root user ARN in the 'Principal' element.
- C
Deny access to all principals and explicitly allow access to a specific AWS account using the 'Condition' element with 'aws:PrincipalOrgID'.
- D
Allow access only to a specific AWS account by specifying the account ID in the 'Principal' element.
Show answer and explanation
Correct answer: D
Explanation
To secure an S3 bucket and restrict access to users only from a specific AWS account, you must use a bucket policy with the 'Principal' element specifying the account ID. This ensures that only IAM users, roles, and other resources within that account can access the bucket. The other options either allow broader access, misuse the root user ARN, or rely on conditions irrelevant to this scenario.
- A. Incorrect.
This option is incorrect because allowing all principals would open access to everyone, which is not secure for sensitive data.
- B. Incorrect.
This option is incorrect because using a root user ARN in the 'Principal' element is not a recommended or valid approach for allowing access to an entire AWS account.
- C. Incorrect.
This option is incorrect because 'aws:PrincipalOrgID' is used for conditions related to AWS Organizations and not directly for restricting access to a specific AWS account.
- D. Correct.
This option is correct because specifying the account ID in the 'Principal' element is the correct way to allow access to all IAM users, roles, and services within that AWS account.