Exams / SAP-C03 / Study guide / Data perimeters and external access (Access Analyzer, endpoint policies, Verified Access)
Data perimeters and external access (Access Analyzer, endpoint policies, Verified Access): SAP-C03 study notes and practice questions
What to know about Data perimeters and external access (Access Analyzer, endpoint policies, Verified Access) for the SAP-C03 exam, from the Security, Compliance, and Governance domain (25% of the exam guide), then 2 free questions to test it. Part of the SAP-C03 study guide.
These questions describe a rule such as “data must never leave the organization” or “only corporate networks may reach this bucket,” then ask which combination of controls enforces and proves it.
RCPs apply to resources in member accounts for supported services such as S3, KMS, STS, SQS and Secrets Manager, so one policy at the root covers every bucket without editing each bucket policy.
VPC endpoint policies on gateway or interface endpoints restrict which principals and resources can be reached through that endpoint, which blocks copying data to a personal bucket from inside the VPC.
Allow AWS services acting for you (for example CloudTrail writing logs) with aws:PrincipalIsAWSService or service-specific exceptions, or the perimeter breaks them.
IAM Access Analyzer
External access analyzer (with the organization as the zone of trust) reports resources such as S3 buckets, KMS keys, IAM roles, Lambda functions and Secrets Manager secrets that are shared outside the organization.
Internal access analyzer shows which principals inside the organization can reach selected critical resources.
Unused access analyzer finds unused roles, keys and permissions.
Policy validation and custom policy checks (for example “does this change grant new access?” or “is public access allowed?”) can run in a pipeline before deployment.
Findings flow to EventBridge and Security Hub for automated response.
AWS Verified Access
Gives employees and contractors access to internal applications without a VPN. Every request is evaluated against policies written in Cedar, using signals from an identity trust provider (such as IAM Identity Center or an OIDC IdP) and optional device trust providers.
Supports web applications and, through its client, non-HTTP applications such as SSH and RDP targets. Logs every access attempt.
How to choose
Scenario wording
Pick
Block access from outside the organization to all buckets and keys
RCP with aws:PrincipalOrgID
Stop employees copying data to their own accounts
SCP or endpoint policy with aws:ResourceOrgID
Bucket reachable only through a specific VPC endpoint
Bucket policy or RCP with aws:SourceVpce
Find everything shared outside the organization
Access Analyzer external access, organization zone
Replace VPN for internal web apps with per-request checks
Verified Access
Common traps
Bucket policies edited one by one when an RCP covers the organization.
An SCP to stop outsiders reaching your data. SCPs limit your principals; RCPs and resource policies limit who reaches your resources.
Forgetting AWS service principals, which breaks logging and replication.
A hospital group keeps patient imaging in Amazon S3 buckets across 20 accounts in its AWS organization. A research partner outside the organization has been granted read access to one shared dataset, and an administrator in one account has just changed a bucket policy that now allows the access to every AWS principal.
The security team needs a control that the account administrators cannot override, which stops any principal outside the organization from reading these buckets, whatever a bucket policy says. The control must not block the organization's own accounts or AWS services that legitimately access the buckets.
Which solution meets these requirements?
Choose one answer.
AA. Attach a service control policy to the organization root that denies s3:GetObject when aws:PrincipalOrgID does not match the organization ID.
BB. Turn on S3 Block Public Access for every bucket in all 20 accounts, so no bucket policy can grant public access.
CC. Add an aws:PrincipalOrgID condition to the bucket policy of every bucket in each account, so that only principals in the organization can read the buckets, and add it to the template for new buckets.
DD. Attach a resource control policy to the organization root that denies s3:GetObject when aws:PrincipalOrgID does not match, with exceptions for the AWS service principals that need access.
Show the answer and explanation
Answer: D
A. Wrong: SCPs limit what principals inside member accounts can do. They do not apply to an external principal's access to a bucket in the organization, so the external reader would not be stopped.
B. Wrong: Block Public Access stops anonymous and public grants, but it does not stop access granted to one named external account. The partner's access would still work.
C. Wrong: This works while each bucket policy stays correct, but an account administrator can change the policy. The control does not hold centrally, which is the requirement the security team set.
D. Right: Correct. Resource control policies apply to resources in member accounts, so the deny holds regardless of the bucket policy. The org ID condition blocks external principals, and the service principal exception keeps legitimate AWS services working.
Explanation
An RCP is the organization-level control that applies to the resources themselves, so it holds regardless of bucket policy edits by account administrators. SCPs do not cover external principals, and Block Public Access and per-bucket conditions leave the named partner access or the central control unmet.
A hospital group's analytics team reads imaging data from an S3 bucket in its organization. The security team requires that the data may be read only through the group's own VPC endpoint for S3, and only by principals in the group's organization.
The endpoint and the bucket are both controlled by the central security team, and the team must allow the analytics jobs, which run in the group's VPCs, to keep working without adding a public route. Requests from the internet, or from another VPC's endpoint, must fail.
Which TWO controls meet these requirements? (Choose two.)
Choose two answers.
AA. Give the VPC endpoint a policy that allows s3:* for every principal, and leave the bucket policy unchanged, so the endpoint carries the traffic privately.
BB. Add a bucket policy statement that denies all s3 actions when aws:SourceVpce is not one of the group's endpoint IDs, so requests must come through the group's own endpoint.
CC. Turn on S3 Block Public Access on the bucket and enable server-side encryption with a customer managed key, so only the encrypted private path can read the objects.
DD. Create a service control policy that denies all S3 calls unless they come through a VPC endpoint, and attach it to the organization root.
EE. Give the VPC endpoint a policy that allows only principals whose aws:PrincipalOrgID matches the organization ID and that access only the group's bucket.
Show the answer and explanation
Answers: B, E
A. Wrong: An endpoint policy that allows every principal does not check who is calling, and without a bucket condition, requests from outside the endpoint are not blocked. This does not meet the organization requirement.
B. Right: Correct. The deny is enforced on the bucket side and blocks requests from any other endpoint or from the internet. Analytics jobs still succeed through the group's endpoint.
C. Wrong: Block Public Access and encryption do not check which endpoint or principal makes the call. A reader with the right IAM permissions could still read the objects from anywhere.
D. Wrong: An SCP restricts only principals in the organization's member accounts, so it does not stop a principal outside the organization from reading the bucket. The perimeter has to be enforced in the bucket and endpoint policies.
E. Right: Correct. The endpoint policy limits which organization principals can reach S3 through this endpoint, so the organization check and the bucket restriction apply on the private path. Analytics jobs in the group's VPCs keep working.
Explanation
A bucket policy that requires the group's endpoint IDs and an endpoint policy that requires organization principals together form the network and identity perimeter. An open endpoint policy, an SCP alone, and encryption or Block Public Access each leave requests from outside the perimeter allowed.
Want more on Data perimeters and external access (Access Analyzer, endpoint policies, Verified Access)? The 5 full-length practice sets have 7 more Data perimeters and external access (Access Analyzer, endpoint policies, Verified Access) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study Data perimeters and external access (Access Analyzer, endpoint policies, Verified Access)