SOA-C02 Question 167
Single answerYour company has a compliance requirement to ensure that all S3 bucket policies are periodically reviewed and do not allow public access. You need to implement a solution that automatically detects and alerts the team if a bucket becomes publicly accessible. Which solution meets this requirement?
- A
Enable AWS Config with the managed rule 's3-bucket-public-read-prohibited' and configure an Amazon SNS topic for alerts.
- B
Use Amazon S3 Access Analyzer to monitor bucket policies and automatically block public access.
- C
Enable AWS Shield Advanced to monitor S3 buckets for public access violations.
- D
Create a Lambda function to scan S3 bucket policies periodically and send findings to Amazon CloudWatch.
Show answer and explanation
Correct answer: A
Explanation
AWS Config is the most suitable solution for compliance monitoring of S3 bucket policies. By enabling the managed rule 's3-bucket-public-read-prohibited', you can automatically evaluate the compliance of S3 bucket policies and configure alerts through Amazon SNS. This ensures that the team is promptly notified if a bucket becomes publicly accessible, fulfilling the compliance requirement.
- A. Correct.
This is the correct solution. AWS Config provides a managed rule 's3-bucket-public-read-prohibited' to check bucket policies for public access. You can configure an Amazon SNS topic to receive notifications whenever the rule is non-compliant.
- B. Incorrect.
While Amazon S3 Access Analyzer can help identify public access, it does not automatically alert or provide compliance monitoring for periodic checks. It is more suited for analyzing access policies at a point in time.
- C. Incorrect.
AWS Shield Advanced is a service designed to protect against DDoS attacks and does not monitor S3 bucket access policies.
- D. Incorrect.
Although a Lambda function could be used to achieve this, it would require custom scripting and management. AWS Config is a more efficient and native solution for compliance monitoring.