Q74 — AWS SAA-C03 Ch.16

Question 74 of 100 | ← Chapter 16

Q1274. A company runs an application as a task in an Amazon Elastic Container Service(Amazon ECS) cluster. The application must have read and write access to a specific group of Amazon S3 buckets. The S3 buckets are in the same AWS Region and AWS account as the ECS cluster. The company needs to grant the application access to the S3 buckets according to the principle of least privilege.Which combination of solutions will meet these requirements?(Select TWO.)

• A. Add a tag to each bucket. Create an IAM policy that includes a StringEquals condition that matches the tags and values of the buckets.
• B. Create an IAM policy that lists the full Amazon Resource Name(ARN) for each S3 bucket. ✓
• C. Attach the IAM policy to the instance role of the ECS task.
• D. Create an IAM policy that includes a wildcard Amazon Resource Name(ARN) that matches all combinations of the S3 bucket names.
• E. Attach the IAM policy to the task role of the ECS task. ✓

Correct Answer: B. Create an IAM policy that lists the full Amazon Resource Name(ARN) for each S3 bucket., E. Attach the IAM policy to the task role of the ECS task.

Explanation

The correct solutions must ensure that the ECS task has least-privilege access to specific S3 buckets while following AWS best practices. Let's evaluate the options:Correct Answers: B & EWhy These Options Are Best:B. Create an IAM policy that lists the full Amazon Resource Name (ARN) for each S3 bucket. Least Privilege: Explicitly listing bucket ARNs ensures the policy only grants access to the required buckets (no over-permissioning).Example Policy:json{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Action": ["s3:GetObject", "s3:PutObject"],"Resource": ["arn:aws:s3:::bucket1/","arn:aws:s3:::bucket2/"]}]}E. Attach the IAM policy to the task role of the ECS task.Task Role (Correct Assignment):The ECS task role defines permissions for the containerized application running in the task. The instance role (Option C) is for the EC2 instance hosting the ECS cluster, not the application itself. Assigning to the task role ensures fine-grained access control at the application level.Why Other Options Fail:A. Add a tag to each bucket. Create an IAM policy that includes a StringEquals condition that matches the tags and values of the buckets.Not Recommended for Least Privilege:While tag-based policies are possible, they are less precise than explicit ARNs. Tags can be modified, leading to potential misconfigurations. AWS recommends resource-specific ARNs for least privilege. C. Attach the IAM policy to the instance role of the ECS task.Incorrect Role Assignment:The instance role grants permissions to the EC2 host, not the containerized application. This would over-permission the host and violate least privilege. D. Create an IAM policy that includes a wildcard Amazon Resource Name (ARN) that matches all combinations of the S3 bucket names.Violates Least Privilege:Wildcards (arn:aws:s3:::) grant access to all buckets, which is insecure.The requirement specifies specific buckets only.Key Comparison:RequirementB (Explicit ARNs) & E (Task Role)Other OptionsLeast Privilege Access(Only specified buckets) (Tags/wildcards are less precise) Correct IAM Role Assignment(Task role for the application) (Instance role = host permissions) Security Best Practices(Explicit > Tags > Wildcards) (Wildcards = insecure)Conclusion:The correct combination is:B (Explicit ARNs) ?Ensures least privilege.E (Task Role) ?Assigns permissions to the application, not the host.Final Answers: B & E