Q34 — AWS SAA-C03 Ch.10

Question 34 of 100 | ← Chapter 10

Q634. A company uses multiple vendors to distribute digital assets that are stored in Amazon S3 buckets. The company wants to ensure that its vendor AWS accounts have the minimum access that is needed to download objects in these S3 Buckets.Which solution will meet these requirements with the LEAST operational overhead?

• A. Design a bucket policy that has anonymous read permissions and permissions to list all buckets
• B. Design a bucket policy that gives read-only access to users. Specify IAM entities as principals
• C. Create a cross-account IAM role that has a read-only access policy specified for the IAM role ✓
• D. Create a user policy and vendor user groups that give read-only access to vendor users

Correct Answer: C. Create a cross-account IAM role that has a read-only access policy specified for the IAM role

Explanation

To ensure that vendor AWS accounts have the minimum access needed to download objects in the S3 buckets, creating a cross-account IAM role is a suitable solution with the least operational overhead. Option C is the correct solution. By creating a cross-account IAM role and specifying a read-only access policy for the role, the company can grant the necessary permissions to the vendor AWS accounts without having to manage individual user policies or groups. This allows for centralized control and easy management of access across multiple vendors.Option A is incorrect because granting anonymous read permissions is not recommended as it can expose the company's data to the public.Option B is incorrect because specifying IAM entities as principals would require managing individual user policies, which can result in more operational overhead.Option D is incorrect because creating user policies and vendor user groups would also require managing individual user policies and groups, resulting in more operational overhead compared to using a cross- account IAM role.