Q13 — AWS SAA-C03 Ch.6
Question 13 of 65 | ← Chapter 6
Q378. A company collects 10 GB of telemetry data daily from various machines. The company stores the data in an Amazon S3 bucket in a source data account.The company has hired several consulting agencies to use this data for analysis. Each agency needs read access to the data for its analysts. The company must share the data from the source data account by choosing a solution that maximizes security and operational efficiency.Which solution will meet these requirements?
- A. Configure S3 global tables to replicate data for each agency
- B. Make the S3 bucket public for a limited time. Inform only the agencies
- C. Configure cross-account access for the S3 bucket to the accounts that the agencies own ✓
- D. Set up an IAM user for each analyst in the source data account. Grant each user access to the S3 bucket
Correct Answer: C. Configure cross-account access for the S3 bucket to the accounts that the agencies own
Explanation
To meet the requirements of maximizing security and operational efficiency while sharing the telemetry data with multiple consulting agencies, you can use AWS's cross-account access and IAM roles. Here's a solution that can help achieve this:Create an AWS account for each consulting agency. These will be the destination accounts. In the source data account, create an IAM role with read-only access the S3 bucket containing the telemetry data. This role will be assumed by the analysts from the consulting agencies. Configure a bucket policy on the S3 bucket in the source data account to allow access from the IAM roles in the destination accounts. The policy should grant s3:GetObject permissions to the IAM roles from the destination accounts4. In each destination account, create an IAM role that allows the analysts to assume the IAM role in the source data account.Share the ARN (Amazon Resource Name) of the IAM role in the source data account with the respective consulting agency.Each consulting agency can then assume the IAM role in the source data account using AWS Security Token Service (STS) and retrieve the telemetry data from the S3 bucket. By implementing this solution, you ensure that each consulting agency has read access to the telemetry data while maintaining security through IAM roles and cross-account access. Additionally, it provides operational efficiency as the agencies can directly access the data without requiring data transfers or duplicating the data across multiple accounts.