SCS-C02 Question 502
Select 4Your organization is reviewing its security practices using the AWS Well-Architected Framework. As part of the Security Pillar, your team wants to ensure that access to sensitive data in Amazon S3 is properly restricted and monitored. Which combination of actions aligns with the Well-Architected Framework's best practices for securing sensitive data in S3?
- A
Enable Amazon S3 bucket logging and monitor logs using Amazon CloudWatch.
- B
Use bucket policies to allow public read access for all objects to simplify access management.
- C
Enable server-side encryption (SSE) for all objects stored in the bucket.
- D
Implement AWS Identity and Access Management (IAM) policies with least privilege principles.
- E
Use an Amazon S3 Access Point with restricted access for applications requiring data access.
Show answer and explanation
Correct answers: A, C, D, E
Explanation
The AWS Well-Architected Framework's Security Pillar emphasizes principles such as least privilege, encryption, monitoring, and visibility. Enabling bucket logging, using server-side encryption, applying least privilege IAM policies, and leveraging S3 Access Points for controlled data access are all measures that enhance security for sensitive data in Amazon S3. Allowing public read access, however, directly violates best practices and should be avoided.
- A. Correct.
Enabling Amazon S3 bucket logging and monitoring logs in CloudWatch aligns with the Security Pillar by providing visibility into data access and potential unauthorized actions.
- B. Incorrect.
Allowing public read access to all objects contradicts security best practices, as it unnecessarily exposes sensitive data to the public.
- C. Correct.
Enabling server-side encryption for objects ensures data at rest is protected, which is a critical security measure.
- D. Correct.
Using IAM policies with least privilege ensures that users and applications only have the permissions they need, reducing the risk of accidental or malicious misuse.
- E. Correct.
Using Amazon S3 Access Points with restricted access allows fine-grained access control for applications, aligning with the principle of least privilege and improving security.