Q69 — AWS SAA-C03 Ch.15

Question 69 of 100 | ← Chapter 15

Q1169. A company stores data for multiple business units in a single Amazon S3 bucket that is in the company's payer AWS account. To maintain data isolation, the business units store data in separate prefixes in the S3 bucket by using an S3 bucket policy.The company plans to add a large number of dynamic prefixes.The company does not want to rely on a single S3 bucket policy to manage data access at scale.The company wants to develop a secure access management solution in addition to the bucket policy to enforce prefix-level data isolation.Which solution will meet these requirements?

• A. Configure the S3 bucket policy to deny s3:GetObject permissions for all users. Configure the bucket policy to allow s3:* access to individual business units.
• B. Enable default encryption on the S3 bucket by using server-side encryption with Amazon S3 managed keys (SSE-S3).
• C. Configure resource-based permissions on the S3 bucket by creating an S3 access point for each business unit. ✓
• D. Use pre-signed URLs to provide access to the S3 bucket.

Correct Answer: C. Configure resource-based permissions on the S3 bucket by creating an S3 access point for each business unit.

Explanation

For the company's requirement of implementing prefix-level data isolation in a single Amazon S3 bucket for multiple business units while avoiding reliance on a single bucket policy for large-scale access management, Option C (configuring S3 access points with resource-based permissions for each business unit) is the best solution. Here's the detailed analysis:Option Analysis:Option A:This approach denies s3:GetObject permissions for all users via the bucket policy and then grants s3:* permissions to individual business units.Drawbacks:The s3:* permission is overly broad, allowing all S3 operations, which poses security risks. Managing separate permissions for each business unit becomes complex and unscalable as the number of units grows, making it difficult to handle dynamic prefixes efficiently.Option B:Enabling default encryption with SSE-S3 only enhances data confidentiality by preventing unauthorized access during transit or storage.Drawback:It does not address prefix-based data isolation or access management, so it fails to meet the company's core requirements.Option C:S3 access points provide dedicated access control policies for each business unit.Advantages:By creating separate access points for each business unit, you can define specific resource-based permissions to control access to particular prefixes.This approach scales well with dynamic prefixes, as it avoids frequent modifications to the bucket policy, reducing management complexity while ensuring data isolation and security.Option D:Pre-signed URLs are primarily used for temporary authorization of third-party users to upload or download specific objects.Drawback:They are a time-based temporary access mechanism and not suitable for long-term data isolation and access management.For regular data access needs of internal business units, pre-signed URLs are impractical and do not meet the company's requirements.Conclusion:Option C leverages S3 access points to provide independent access control policies for each business unit, enabling fine-grained prefix-based access management. This solution effectively addresses the challenges posed by dynamic prefixes, reduces management overhead, and ensures data isolation and security, making it the best fit for the company's needs.