SAA-C03 practice question: S3 access control (2 of 2)
Design Secure Architectures A free question from our original SAA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A marketing company has one AWS account with about 300 Amazon S3 buckets, and teams create new buckets every week.
Team leads have full permissions on their own buckets, including editing bucket policies, ACLs and bucket-level settings. After a competitor's data leak, the company wants to guarantee that no bucket, existing or future, can be made public, whatever a team lead changes.
Which solution meets this requirement with the LEAST effort?
Choose one answer.
AA. Turn on all four S3 Block Public Access settings at the account level, and allow only the security team to change account-level settings.
BB. Run a script that turns on all four Block Public Access settings on each existing bucket, and ask teams to keep them on for new buckets.
CC. Deploy the AWS Config s3-bucket-public-read-prohibited rule with automatic remediation that removes public statements from bucket policies.
DD. Set Object Ownership to bucket owner enforced on every bucket, so that ACLs are disabled and can no longer grant any public access.
Show the answer and explanation
Answer: A
A. Right: Correct. Account-level Block Public Access applies to every current and future bucket, and S3 uses the most restrictive of the account and bucket settings. A team lead who edits a bucket policy or bucket setting cannot undo it without s3:PutAccountPublicAccessBlock. Learn more: Blocking public access to your Amazon S3 storage (opens in a new tab)
B. Wrong: Bucket-level settings can be turned off by anyone with s3:PutBucketPublicAccessBlock on that bucket, which the team leads have. It also relies on teams for every new bucket. The account-level setting cannot be overridden from a bucket. Learn more: Blocking public access to your Amazon S3 storage (opens in a new tab)
C. Wrong: This detects public buckets and fixes them after the fact, so a bucket can be public for a while before remediation runs. The company needs a guarantee, which calls for a preventive control. Account-level Block Public Access gives that. Learn more: s3-bucket-public-read-prohibited (opens in a new tab)
S3 Block Public Access at the account level applies to all buckets the account owns, now and in future, and overrides any bucket policy, ACL or bucket-level setting that would allow public access. Changing it needs s3:PutAccountPublicAccessBlock, which can be kept from bucket owners. Detective rules and per-bucket settings leave gaps.
Want more on S3 access control? The 5 full-length practice sets have 10 more S3 access control questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →