Q47 — AWS SAA-C03 Ch.17

Question 47 of 89 | ← Chapter 17

Q1347. A solutions architect has designed an application that gives users the ability to access images that are stored in an Amazon S3 bucket. The application uses an Amazon EC2 instance hosted in a private VPC that has a VPC ID of vpc-11aabb22. The solutions architect enabled the block public access feature on the S3 bucket. The bucket is hosted in the us-west-2 Region of account 123456789012. The solutions architect needs to ensure that only resources within the VPC that hosts the EC2 instance can accessthe S3 bucket.Which solution will meet this requirement?

Correct Answer: A. Create an S3 bucket policy statement that has a Deny effect and a Condition that includes "StringNotEquals": {"aws:SourceVpc":"vpc-11aabb22"}.

Explanation

The correct solution is A. Create an S3 bucket policy statement that has a Deny effect and a Condition that includes "StringNotEquals": {"aws:SourceVpc":"vpc-11aabb22"}.Explanation:Requirement:Only resources within the specific VPC (vpc-11aabb22) should be allowed to access the S3 bucket. The bucket has Block Public Access enabled, so no public access is allowed. The solution must enforce VPC-based access control via an S3 bucket policy.Why Option A is correct:Deny Effect with StringNotEquals Condition:The policy explicitly denies access to any request that does not originate from the specified VPC (vpc- 11aabb22).This ensures that only requests from within the VPC are allowed (implicitly, since all other requests are denied).Correct Condition Key (aws:SourceVpc):The aws:SourceVpc condition key checks the VPC ID from which the request originates. This is the most secure and precise way to restrict access to a specific VPC.Why the other options are incorrect:B. Allow effect with VPC Resource ARNIncorrect because:The Resource field in an S3 bucket policy refers to the S3 bucket/object, not the VPC. This syntax does not restrict access based on the VPC of the requester.C. Allow effect with StringNotEquals ConditionIncorrect because:An Allow policy with StringNotEquals would permit access only if the request does not come from the VPC, which is the opposite of what is needed.This would block access from the VPC and allow all other traffic (unsafe). D. Deny effect with StringNotEquals on aws:PrincipalAccount Incorrect because:This restricts access based on the AWS account ID, not the VPC. It would deny requests from any principal (user/role) not in account 123456789012, but does not enforce VPC-based access.Correct Policy Example (Option A):json{"Version": "2012-10-17","Statement": [{"Effect": "Deny","Principal": "","Action": "s3:","Resource": ["arn:aws:s3:::your-bucket-name","arn:aws:s3:::your-bucket-name/"],"Condition": {"StringNotEquals": {"aws:SourceVpc": "vpc-11aabb22"}}}]}This policy ensures that only requests originating from vpc-11aabb22 are allowed (all others are denied).Conclusion:Option A is the only solution that correctly enforces VPC-based access control using an S3 bucket policy.