Q21 — AWS SAA-C03 Ch.13

Question 21 of 100 | ← Chapter 13

Q921. A company manages a data lake in an Amazon S3 bucket that numerous applications access. The S3 bucket contains a unique prefix for each application. The company wants to restrict each application to its specific prefix and to have granular control of the objects under each prefix.Which solution will meet these requirements with the LEAST operational overhead?

• A. Create dedicated S3 access points and access point policies for each application. ✓
• B. Create an S3 Batch Operations job to set the ACL permissions for each object in the S3 bucket.
• C. Replicate the objects in the S3 bucket to new S3 buckets for each application. Create replication rules by prefix.
• D. Replicate the objects in the S3 bucket to new S3 buckets for each application. Create dedicated S3 access points for each application.

Correct Answer: A. Create dedicated S3 access points and access point policies for each application.

Explanation

To meet the company's requirements of restricting each application to its specific prefix and having granular control of the objects under each prefix with the least operational overhead, the most suitable solution is:A. Create dedicated S3 access points and access point policies for each application.Option A suggests creating dedicated S3 access points and access point policies for each application. An S3 access point is a unique hostname that customers can create and manage to enforce specific permissions and network controls for accessing their S3 buckets. By creating dedicated access points for each application, the company can ensure that access is restricted to the specific prefix associated with each application.Access point policies provide granular control over the permissions granted to each access point. By configuring access point policies, the company can define fine-grained permissions for each application, allowing or denying specific actions on objects within the associated prefix.Option B suggests using S3 Batch Operations to set the ACL permissions for each object in the S3 bucket. While this option may provide granular control over permissions, it requires performing batch operations on a per-object basis, which can be operationally intensive and potentially inefficient for managing access control at scale.Option C suggests replicating objects to new S3 buckets for each application and creating replication rules by prefix. While replication can help isolate data for each application, it introduces additional complexity, management overhead, and potential data synchronization issues between buckets.Option D suggests replicating objects to new S3 buckets for each application and creating dedicated S3 access points for each application. While this option may provide isolation and access control, it introduces unnecessary duplication of data and management overhead with additional access point configuration.In summary, option A, creating dedicated S3 access points and access point policies for each application, provides a scalable and efficient solution for restricting access to specific prefixes and achieving granular control over objects in the S3 bucket with the least operational overhead.