SCS-C02 Question 443
Select 1An organization named 'Account A' needs to allow a development team in another AWS account, 'Account B', to access an S3 bucket in Account A. The development team should be able to upload and read objects in the bucket, but not delete objects. How can this be achieved while following security best practices?
- A
Create an IAM role in Account A with an S3 bucket policy allowing access for the Account B principal and share the role ARN with the development team in Account B.
- B
Create an IAM role in Account A with permissions to upload and read objects in the S3 bucket, and allow Account B to assume this role by specifying their account ID in the trust policy.
- C
Create an S3 bucket policy in Account A granting read and write permissions to the root user of Account B.
- D
Create an IAM user in Account A, attach an S3 access policy to the user, and share the user's credentials with the development team in Account B.
- E
Create an S3 bucket policy allowing public read and write access, and inform the development team in Account B about the bucket URL.
Show answer and explanation
Correct answer: B
Explanation
The best way to securely allow cross-account access to an S3 bucket is by creating an IAM role in the account that owns the bucket (Account A) and specifying the other account (Account B) in the trust policy. This ensures that only authorized entities in Account B can assume the role and perform the allowed actions. Sharing credentials or making resources public violates security best practices and should be avoided.
- A. Incorrect.
This option mentions creating an IAM role with an S3 bucket policy, but it is incorrect because access to the bucket should be controlled through IAM role permissions and trust relationships, not by directly using bucket policies to specify an external principal.
- B. Correct.
This is the correct option because it follows security best practices. By creating an IAM role in Account A with specific permissions and a trust policy allowing Account B to assume the role, you can securely allow cross-account access without sharing credentials or exposing resources unnecessarily.
- C. Incorrect.
Granting permissions to the root user of another account via an S3 bucket policy is highly insecure and violates AWS security best practices, as it could lead to unauthorized access and loss of control over the bucket.
- D. Incorrect.
Sharing IAM user credentials is not a secure practice and violates AWS security best practices. Roles with cross-account trust policies are preferred for secure cross-account access.
- E. Incorrect.
Making the bucket public is insecure and does not align with the principle of least privilege, as it exposes the bucket to unintended access.