SCS-C02 Question 60
Single answerA company is using Amazon S3 buckets to store sensitive customer data. The Security team has discovered that some of the buckets are publicly accessible, potentially exposing sensitive information. To enforce bucket-level security and prevent public access to S3 buckets, which solution provides the BEST approach?
- A
Enable Amazon S3 Block Public Access at the account level.
- B
Use AWS Config to monitor and automatically remediate public S3 buckets.
- C
Enable server-side encryption (SSE) for all S3 buckets.
- D
Apply an S3 bucket policy to explicitly deny public access.
Show answer and explanation
Correct answer: A
Explanation
To prevent public access to S3 buckets, enabling Amazon S3 Block Public Access at the account level is the best approach. It provides a centralized and effective method to ensure no S3 bucket can be publicly accessible, regardless of bucket policies or ACLs. Other options either address different security concerns or are less reliable for preventing public access across an entire AWS account.
- A. Correct.
Enabling Amazon S3 Block Public Access at the account level is the most effective way to prevent public access to S3 buckets across the account. This setting overrides any public permissions and ensures no S3 bucket can be publicly exposed.
- B. Incorrect.
While AWS Config can monitor and remediate public S3 buckets, it is not a preventive measure. AWS Config works on a detection-and-remediation model, which may still leave a window for exposure.
- C. Incorrect.
Server-side encryption (SSE) ensures the data at rest is encrypted but does not prevent public access to S3 buckets. It addresses a different security concern.
- D. Incorrect.
An S3 bucket policy can deny public access, but this approach is prone to human error when managing multiple buckets. Additionally, Block Public Access provides a more comprehensive solution as it works at the account level.