SCS-C02 Question 490
Select 2Your organization wants to enforce strict security controls on how developers can access production S3 buckets. The security team has mandated that all API requests to the bucket must be signed, and any unsigned or unauthorized requests should be denied. Additionally, the security team wants to ensure that only IAM roles assigned to a specific production group can access the bucket. Which of the following configuration steps should you implement to achieve this?
- A
Implement an S3 bucket policy that denies requests without the 'aws:SecureTransport' condition set to true.
- B
Implement an S3 bucket policy that denies requests unless they include a valid 'x-amz-security-token' header.
- C
Use an S3 bucket policy to explicitly allow access only to specific IAM roles belonging to the production group.
- D
Enable the 'Block Public Access' setting on the bucket to prevent public access.
- E
Set up AWS CloudTrail to log all API requests to the bucket for auditing purposes.
Show answer and explanation
Correct answers: B, C
Explanation
To meet the security team's requirements, you need to ensure that all requests are signed and authenticated. The 'x-amz-security-token' header signifies that a request is using temporary credentials, which are signed. Additionally, using an S3 bucket policy to allow access only to specific IAM roles ensures that only authorized production group members can access the bucket. Other options, while beneficial for enhancing security, do not directly fulfill the specific requirements of this scenario.
- A. Incorrect.
This option refers to enforcing TLS encryption for requests using the 'aws:SecureTransport' condition. While it enhances security, it does not enforce signed requests or restrict access to IAM roles.
- B. Correct.
This option enforces the use of temporary credentials, which include the 'x-amz-security-token' header, ensuring that requests are signed. This aligns with the requirement to deny unsigned requests.
- C. Correct.
This option restricts access to specific IAM roles, which aligns with the requirement to ensure only authorized roles from the production group can access the bucket.
- D. Incorrect.
This option is a general best practice to secure S3 buckets but does not address the requirement to enforce signed requests or restrict access to specific IAM roles.
- E. Incorrect.
Setting up AWS CloudTrail is useful for auditing and tracking access to the bucket, but it does not enforce signed requests or restrict access.