nerdexam
Amazon

DOP-C02 · Question #38

A company is using an AWS CodeBuild project to build and package an application. The packages are copied to a shared Amazon S3 bucket before being deployed across multiple AWS accounts. The buildspec.

The correct answer is D. Modify the post_build command to remove --acl authenticated-read and configure a bucket policy. To prevent unauthorized artifact downloads from the S3 bucket, the DevOps engineer must remove the --acl authenticated-read flag from the aws s3 cp command in the buildspec.yml and implement a restrictive S3 bucket policy to grant read access only to authorized AWS accounts.

Submitted by omar99· Mar 6, 2026Security & Compliance

Question

A company is using an AWS CodeBuild project to build and package an application. The packages are copied to a shared Amazon S3 bucket before being deployed across multiple AWS accounts. The buildspec.yml file contains the following:

The DevOps engineer has noticed that anybody with an AWS account is able to download the artifacts. What steps should the DevOps engineer take to stop this?

Options

  • AModify the post_build command to use --acl public-read and configure a bucket policy that grants
  • BConfigure a default ACL for the S3 bucket that defines the set of authenticated users as the
  • CCreate an S3 bucket policy that grants read access to the relevant AWS accounts and denies
  • DModify the post_build command to remove --acl authenticated-read and configure a bucket policy

How the community answered

(51 responses)
  • A
    4% (2)
  • B
    14% (7)
  • C
    6% (3)
  • D
    76% (39)

Why each option

To prevent unauthorized artifact downloads from the S3 bucket, the DevOps engineer must remove the `--acl authenticated-read` flag from the `aws s3 cp` command in the `buildspec.yml` and implement a restrictive S3 bucket policy to grant read access only to authorized AWS accounts.

AModify the post_build command to use --acl public-read and configure a bucket policy that grants

Using `--acl public-read` would make the artifacts publicly accessible to anyone on the internet, which is a severe security vulnerability and exacerbates the problem.

BConfigure a default ACL for the S3 bucket that defines the set of authenticated users as the

Configuring a default ACL that grants authenticated users access would continue or reintroduce the problem of overly permissive access for any AWS authenticated principal.

CCreate an S3 bucket policy that grants read access to the relevant AWS accounts and denies

While creating an S3 bucket policy to grant specific access is crucial, it may not effectively override an explicit, more permissive object ACL like `authenticated-read` if that ACL is still being applied during upload.

DModify the post_build command to remove --acl authenticated-read and configure a bucket policyCorrect

The `--acl authenticated-read` option grants read access to any AWS authenticated user, which is the direct cause of the current problem. Removing this ACL and configuring a bucket policy that explicitly grants read access only to the relevant AWS accounts ensures adherence to the principle of least privilege.

Concept tested: S3 access control with ACLs and bucket policies

Source: https://docs.aws.amazon.com/AmazonS3/latest/userguide/acls-overview.html

Topics

#S3 security#S3 ACLs#S3 Bucket Policy#CodeBuild artifacts

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full DOP-C02 Practice