Q41 — AWS SAA-C03 Ch.17

Question 41 of 89 | ← Chapter 17

Q1341. A company has stored a file in an Amazon S3 bucket. The file contains IP address allow lists and IP address deny lists. The company needs to be able to access the file by using an HTTP endpoint. The company's firewalls, which are not deployed on AWS, need to be able to read the file. The company wants to restrict access to the file to only the firewall IP addresses. The company has configured the Amazon S3 Block Public Access feature for this AWS account.Which solution meets these requirements?

• A. Configure the S3 bucket as a static website. Create a bucket policy that restricts website access to only the firewall IP addresses. Add the static website's URL to the firewall settings.
• B. Create a bucket policy that explicitly allows access from only the firewall IP addresses. Add the file's URL to the firewall settings. ✓
• C. Create an Amazon CloudFront distribution. Add the S3 bucket as the origin. Create an origin access control(OAC) that allows access from only the firewall IP solution meets these requirements?
• D. Create an AWS Lambda function that has access to the file. Configure the Lambda function to confirm if the IP address in the request is from one of the firewalls and return the lists. Add the Lambda function URL to the firewall settings.

Correct Answer: B. Create a bucket policy that explicitly allows access from only the firewall IP addresses. Add the file's URL to the firewall settings.

Explanation

B OR D.Let's analyze each option to determine which one meets the requirements:Requirements RecapThe file in the Amazon S3 bucket (containing IP address allow/deny lists) needs to be accessible via an HTTP endpoint.The company's non - AWS firewalls need to be able to read the file. Access to the file should be restricted to only the firewall IP addresses. Amazon S3 Block Public Access is enabled for the AWS account.Option AS3 Static Website: When you configure an S3 bucket as a static website, it makes the objects in the bucket publicly accessible by default (unless explicitly restricted). However, since Amazon S3 Block Public Access is enabled, this feature will prevent the bucket from being configured as a public static website. Even if we try to create a bucket policy to restrict access to firewall IPs, the S3 Block Public Access settings may override some of these permissions and still pose security risks. So, this option is not viable.Option BBucket Policy for IP Restriction: You can create an S3 bucket policy that uses the aws:SourceIp condition key to explicitly allow access to the file only from the specified firewall IP addresses. Access via File URL: Once the bucket policy is in place, the firewall can access the file using its direct S3 object URL. This approach is straightforward and leverages the native access control mechanisms of S3. It meets the requirement of restricting access to specific IP addresses and allows the firewall to read the file via an HTTP - like URL (the S3 object URL).Option CCloudFront with Origin Access Control (OAC): Origin Access Control in CloudFront is mainly used to control access between CloudFront and the origin (in this case, the S3 bucket). It is designed to prevent direct access to the S3 bucket from the internet and force all requests to go through CloudFront. But the requirement here is to restrict access based on the source IP address of the firewall. While CloudFront can be configured with IP - based access restrictions at the distribution level, using OAC in this context does not directly address the need to allow only firewall IPs to access the S3 file. Also, the setup is more complex than necessary for this simple IP - based access control requirement.Option DLambda Function for IP Validation: Creating an AWS Lambda function to validate the IP address of the incoming request and return the file contents adds unnecessary complexity. It requires additional development and maintenance effort. Moreover, it introduces an extra layer of processing and potential latency. The native S3 bucket policy can achieve the same IP - based access control in a more efficient and straightforward manner.Therefore, the solution that meets the requirements is Option B.So the answer is B.