Q51 — AWS SAA-C03 Ch.17

Question 51 of 89 | ← Chapter 17

Q1351. A company must give a small group of auditors read-only access to an only access to an Amazon S3 bucket that stores sensitive audit logs. The auditors will review the logs once each month. The company has provisioned an IAM user for each auditor.The company must use the following specifications:The bucket remains private to the account.Credentials are temporary and rotate automatically.Access expires at the end of the monthly review period.All activity is traceable to individual users in AWS CloudTrail.Which solution will meet these requirements?

• A. Generate pre-signed URLs for the required objects that expire at end of the review period. Send the objects to the auditors before each review day.
• B. Create an IAM role with read-only S3 bucket access. Include a condition that allows auditors assume this access during the monthly review period. ✓
• C. Add each auditor's IAM user to the bucket ACL with Read permissions. Remove each auditor's IAM user from the bucket ACL after the review period.
• D. Enable S3 static website hosting. Restrict access to each auditor' s corporate IP address range by using a bucket policy with a condition that allows access only during the review period.

Correct Answer: B. Create an IAM role with read-only S3 bucket access. Include a condition that allows auditors assume this access during the monthly review period.

Explanation

The correct solution is B. Create an IAM role with read-only S3 bucket access. Include a condition that allows auditors to assume this access during the monthly review period.Explanation:The requirements are:Bucket remains private (no public access).Temporary, auto-rotating credentials (no long-term IAM user credentials).Access expires automatically after the review period.Traceable activity in AWS CloudTrail (IAM roles provide auditability).Why Option B is correct:IAM Role with Conditions:An IAM role allows temporary credentials (via sts:AssumeRole) that rotate automatically. A trust policy can restrict which IAM users (auditors) can assume the role.A permissions policy can grant read-only S3 access.A condition (e.g., DateLessThan) can enforce that the role can only be assumed during the monthly review period (e.g., "DateLessThan": {"AWS:CurrentTime": "2024-11-30T00:00:00Z"}). CloudTrail logs will show which auditor assumed the role and when.Why the other options are incorrect:A. Generate pre-signed URLs for the required objectsIncorrect:Pre-signed URLs provide object-level access, not bucket-level read-only access. Requires regenerating URLs manually each month (no automatic expiration based on time). No audit trail in CloudTrail for who used the URL (only the IAM user who generated it). C. Add each auditor's IAM user to the bucket ACL with Read permissions Incorrect:Bucket ACLs are deprecated for fine-grained access control (use bucket policies or IAM instead). Requires manual removal of users after the review period (no automatic expiration). Long-term credentials (IAM users) are used, not temporary ones. D. Enable S3 static website hosting + IP-based bucket policy Incorrect:Static website hosting makes the bucket publicly accessible (violates the "private bucket" requirement). IP-based restrictions are unreliable (corporate IPs can change or be spoofed). No temporary credentials--auditors would need long-term access.Correct Approach (Option B):Create an IAM Role (AuditRole) with:Trust Policy: Allows auditors' IAM users to assume the role. Permissions Policy: Grants s3:GetObject (or s3:ListBucket + s3:GetObject) on the audit logs bucket. Condition: Restricts assumption to the review period (e.g., DateLessThan). Auditors use aws sts assume-role to get temporary credentials during the review window. CloudTrail logs capture all AssumeRole actions, linking activity to individual auditors.Example IAM Role Policies:Trust Policy (allows auditors to assume the role):json{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Principal": {"AWS": ["arn:aws:iam::123456789012:user/auditor1", "arn:aws:iam::123456789012:user/ auditor2"]},"Action": "sts:AssumeRole","Condition": {"DateLessThan": {"AWS:CurrentTime": "2024-11-30T00:00:00Z"} // Expires after review period }}]}Permissions Policy (read-only S3 access):json{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Action": ["s3:ListBucket", "s3:GetObject"],"Resource": ["arn:aws:s3:::audit-logs-bucket", "arn:aws:s3:::audit-logs-bucket/"] }]}Conclusion:Option B is the only solution that meets all requirements:Private bucket (no public access).Temporary, auto-rotating credentials (via IAM roles).Automatic expiration (via role conditions).Auditability (CloudTrail tracks AssumeRole actions).The other options fail on security, automation, or auditability.