Q21 — AWS SAA-C03 Ch.12

Question 21 of 100 | ← Chapter 12

Q821. A company has an Amazon Elastic File System (Amazon EFS) file system that contains a reference dataset. The company has applications on Amazon EC2 instances that need to read the dataset. However, the applications must not be able to change the dataset. The company wants to use IAM access control to prevent the applications from being able to modify or delete the dataset.Which solution will meet these requirements?

• A. Mount the EFS file system in read-only mode from within the EC2 instances.
• B. Create a resource policy for the EFS file system that denies the elasticfilesystem:ClientWrite action to the IAM roles that are attached to the EC2 instances.
• C. Create an identity policy for the EFS file system that denies the elasticfilesystem:ClientWrite action on the EFS file system. ✓
• D. Create an EFS access point for each application. Use Portable Operating System Interface (POSIX) file permissions to allow read-only access to files in the root directory.

Correct Answer: C. Create an identity policy for the EFS file system that denies the elasticfilesystem:ClientWrite action on the EFS file system.

Explanation

By creating an identity policy for the EFS file system that denies the elasticfilesystem:ClientWrite action, you can prevent the applications running on the EC2 instances from being able to modify or delete the dataset. Identity policies are used to control access for individual IAM users or roles.Mounting the EFS file system in read-only mode (option A) could prevent the applications from modifying the dataset, but it does not provide the same level of control and security as using IAM access control policies.Creating a resource policy for the EFS file system (option B) is not the recommended approach because resource policies are used to control access at the file system level and are not designed to restrict actions for IAM roles or users.Creating an EFS access point for each application with POSIX file permissions (option D) can provide read-only access to files in the root directory, but it does not prevent modifications to the dataset at the file system level.Therefore, option C, creating an identity policy that denies the elasticfilesystem:ClientWrite action on the EFS file system, is the appropriate solution to prevent the applications from modifying or deleting the dataset while using IAM access control.