Q45 — AWS SAA-C03 Ch.15

Question 45 of 100 | ← Chapter 15

Q1145. A company operates an online photo-sharing service and stores data in AWS Account A in a centralized Amazon S3 bucket.The company wants to grant a second AWS account named Account B access to the centralized S3 bucket. The company owns Account B.Which solution will meet this requirement?

Correct Answer: D. Create a bucket policy that grants Account B permission to access the centralized S3 bucket in Account A,

Explanation

Let's analyze the requirement and the options to determine the best solution for granting Account B access to a centralized Amazon S3 bucket in Account A.Key Requirement:Grant Account B Access to S3 Bucket in Account A: The company wants to allow Account B (which it owns) to access an S3 bucket in Account A.Key AWS Concepts:S3 Bucket Policies: Used to grant cross-account access to an S3 bucket. You can specify another AWS account (by its account ID) and grant it permissions (e.g., s3:GetObject, s3:ListBucket). Cross-Account IAM Roles: Another way to grant cross-account access, but the question does not mention requiring IAM roles (a bucket policy is simpler for this use case). S3 Transfer Acceleration: Used to speed up uploads/downloads over long distances, not for granting cross- account access.Cross-Region Replication: Used to replicate data between S3 buckets in different regions, not for granting access.Amazon CloudFront: A CDN for distributing content, not for granting cross-account access (though it can use S3 as an origin).Analysis of Options:Option A:Enable S3 Transfer Acceleration: This is used to speed up uploads/downloads over long distances by using AWS's edge locations. It does not grant cross-account access. Conclusion: Incorrect because it does not meet the requirement.Option B:Enable Cross-Region Replication: This replicates data between S3 buckets in different regions. It does not grant cross-account access.Conclusion: Incorrect because it does not meet the requirement.Option C:Use Amazon CloudFront to Distribute S3 Bucket Contents: CloudFront can distribute S3 content, but granting access via signed URLs is not a cross-account access mechanism. Signed URLs are for temporary access to specific objects, not for granting an entire account access. Grant Account B Access via Signed URL: Signed URLs are not used for cross-account access (they are for granting temporary access to a specific object, often to public users). Conclusion: Incorrect because it does not provide cross-account access.Option D:Create a Bucket Policy that Grants Account B Permission: This is the correct approach. You can create an S3 bucket policy in Account A that explicitly grants Account B (by its account ID) permissions to access the bucket (e.g., s3:GetObject, s3:ListBucket).Example Bucket Policy:json{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Principal": {"AWS": "arn:aws:iam::ACCOUNT_B_ID:root"},"Action": ["s3:GetObject", "s3:ListBucket"],"Resource": ["arn:aws:s3:::your-bucket-name/*", "arn:aws:s3:::your-bucket-name"] }]}Conclusion: This is the correct solution.Why Not Other Options?A: S3 Transfer Acceleration is for speed, not cross-account access.B: Cross-Region Replication is for data replication, not access.C: CloudFront + Signed URLs are not for cross-account access (signed URLs are for temporary public access).Final Answer:D is the correct solution. Creating a bucket policy in Account A that grants Account B permission to access the S3 bucket is the simplest and most direct way to meet the requirement.答案:D