DOP-C02 · Question #276
A company has an organization in AWS Organizations. A DevOps engineer needs to maintain multiple AWS accounts that belong to different OUs in the organization. All resources, including IAM policies…
The correct answer is D. Ensure that no SCP is blocking access for developers to the S3 bucket. Ensure that no IAM policy. Comprehensive approach: Reviews both SCPs and IAM permissions boundaries that could - Changes are committed to CodeCommit and deployed through CloudFormation, maintaining the required deployment pipeline. - By checking both SCPs and permissions boundaries, this solution covers…
Question
A company has an organization in AWS Organizations. A DevOps engineer needs to maintain multiple AWS accounts that belong to different OUs in the organization. All resources, including IAM policies and Amazon S3 policies within an account, are deployed through AWS CloudFormation. All templates and code are maintained in an AWS CodeCommit repository. Recently, some developers have not been able to access an S3 bucket from some accounts in the organization. The following policy is attached to the S3 bucket:
What should the DevOps engineer do to resolve this access issue?
Options
- AModify the S3 bucket policy. Turn off the S3 Block Public Access setting on the S3 bucket. In the
- BVerify that no IAM permissions boundaries are denying developers access to the S3 bucket.
- CConfigure an SCP that stops anyone from modifying IAM resources in developer OUs. In the S3
- DEnsure that no SCP is blocking access for developers to the S3 bucket. Ensure that no IAM policy
How the community answered
(29 responses)- A17% (5)
- B7% (2)
- C31% (9)
- D45% (13)
Explanation
- Comprehensive approach: Reviews both SCPs and IAM permissions boundaries that could - Changes are committed to CodeCommit and deployed through CloudFormation, maintaining the required deployment pipeline. - By checking both SCPs and permissions boundaries, this solution covers potential organizational and account-level restrictions that could impact access.
Topics
Community Discussion
No community discussion yet for this question.