SCS-C02 Question 501
Single answerYou are a security engineer reviewing an existing application deployed on AWS to ensure it aligns with the AWS Well-Architected Framework's Security Pillar. During the review, you notice that the application stores sensitive customer data in Amazon S3, but the bucket permissions are set to 'Public Access'. What is the most appropriate action to take to improve the security of the S3 bucket while adhering to the Well-Architected Framework?
- A
Enable server-side encryption on the S3 bucket using AWS Key Management Service (KMS).
- B
Update the bucket policy to explicitly deny public access and enable S3 Block Public Access.
- C
Move the S3 bucket to a private VPC endpoint to isolate it from the public internet.
- D
Enable S3 Transfer Acceleration to securely transfer data to the bucket.
Show answer and explanation
Correct answer: B
Explanation
The AWS Well-Architected Framework's Security Pillar emphasizes protecting data in transit and at rest, as well as managing access permissions. In this scenario, the primary issue is the public access permissions on the S3 bucket, which exposes sensitive customer data. By updating the bucket policy to explicitly deny public access and enabling S3 Block Public Access, you mitigate the risk of unauthorized access and align with best practices for securing S3 buckets.
- A. Incorrect.
While enabling server-side encryption with AWS KMS is a best practice, it does not address the immediate issue of public access to the bucket.
- B. Correct.
Updating the bucket policy to deny public access and enabling S3 Block Public Access directly resolves the security risk of the bucket being publicly accessible, aligning with the principles of the Security Pillar in the AWS Well-Architected Framework.
- C. Incorrect.
Moving the S3 bucket to a private VPC endpoint is a valid way to provide additional network isolation, but it does not directly address the public bucket permissions issue.
- D. Incorrect.
Enabling S3 Transfer Acceleration can enhance data transfer speed and security, but it is unrelated to the problem of public bucket access.