Q40 — AWS SAA-C03 Ch.15

Question 40 of 100 | ← Chapter 15

Q1140. An international company needs to share data from an Amazon S3 bucket to employees who are located around the world. The company needs a secure solution to provide employees with access to the S3 bucket. The employees are already enrolled in AWS IAM Identity Center.Which solution will meet these requirements with the LEAST operational overhead?

• A. Create a help desk application to generate an Amazon S3 presigned URL for each employee.Configure the presigned URLs to have short expirations. Instruct employees to contact the company help desk to receive a presigned URL to access the S3 bucket.
• B. Create a group for Amazon S3 access in IAM Identity Center. Add the employees who require access to the S3 bucket to the group. Create an IAM policy to allow Amazon S3 access from them group.Instruct employees to use the AWS access portal to access the AWS Management Console and navigate to the S3 bucket. ✓
• C. Create an Amazon S3 File Gateway. Create one share for data uploads and a second share for data downloads. Set up an SFTP service on an Amazon EC2 instance.Mount the shares to the EC2 instance. Instruct employees to use the SFTP server.
• D. Configure AWS Transfer Family SFTP endpoints. Select the custom identity provider option. Use AWS Secrets Manager to manage the user credentials. Instruct employees to use Transfer Family SFTP.

Correct Answer: B. Create a group for Amazon S3 access in IAM Identity Center. Add the employees who require access to the S3 bucket to the group. Create an IAM policy to allow Amazon S3 access from them group.Instruct employees to use the AWS access portal to access the AWS Management Console and navigate to the S3 bucket.

Explanation

The solution that will meet the requirements for securely sharing data from an Amazon S3 bucket to employees around the world with the least operational overhead is:B. Create a group for Amazon S3 access in IAM Identity Center. Add the employees who require access to the S3 bucket to the group. Create an IAM policy to allow Amazon S3 access from that group. Instruct employees to use the AWS access portal to access the AWS Management Console and navigate to the S3 bucket.Explanation:IAM Identity Center Integration: By leveraging IAM Identity Center, you can easily manage user access without the need for custom applications or manual URL generation. This approach utilizes existing user enrollments, simplifying management.Group-Based Access Control: Creating a group allows you to manage permissions efficiently. Adding employees to the group automatically grants them the necessary permissions defined in the IAM policy, reducing overhead in managing individual access.AWS Management Console Access: Employees can use the AWS access portal to access the S3 bucket directly, eliminating the need for complex setups or additional services.Why Other Options Are Not Suitable:A: Generating presigned URLs involves manual intervention from a help desk, which increases operational overhead and complexity for ongoing access needs.C: Setting up an S3 File Gateway and an SFTP service on EC2 adds unnecessary complexity and management overhead. It requires additional infrastructure and maintenance.D: Configuring AWS Transfer Family with a custom identity provider and managing user credentials through Secrets Manager adds complexity and operational overhead, especially compared to using IAM Identity Center.Thus, option B provides a secure and efficient way to manage access to the S3 bucket with minimal operational overhead.