DVA-C02 · Question #775
A company has multiple development teams. Each development team runs its own cloud development environment. Each development environment is isolated to its own AWS account. All of the team AWS…
The correct answer is D. Create S3 bucket policies for the S3 buckets in Account B and Account C. Configure the policies. Configuring bucket policies in Accounts B and C to allow the development team’s existing IAM role in Account A to read the source buckets provides direct cross-account access without requiring the team to assume roles in multiple accounts or manage additional identities. This…
Question
A company has multiple development teams. Each development team runs its own cloud development environment. Each development environment is isolated to its own AWS account. All of the team AWS accounts belong to the same organization in AWS Organizations. A development team federates into Account A. The development team must copy objects from Amazon S3 buckets that are in Account B and Account C to an S3 bucket that is in Account A. Which solution will meet these requirements in the MOST operationally efficient way?
Options
- ACreate and deploy a service control policy (SCP) that grants the required access to all S3
- BCreate and configure IAM roles for the development team to assume in Account B and Account
- CCreate IAM users that have full Amazon S3 access for Account B and Account C. Share the IAM
- DCreate S3 bucket policies for the S3 buckets in Account B and Account C. Configure the policies
How the community answered
(31 responses)- A10% (3)
- B3% (1)
- C19% (6)
- D68% (21)
Explanation
Configuring bucket policies in Accounts B and C to allow the development team’s existing IAM role in Account A to read the source buckets provides direct cross-account access without requiring the team to assume roles in multiple accounts or manage additional identities. This minimizes ongoing operational overhead while keeping access tightly scoped to only the required buckets and actions.
Community Discussion
No community discussion yet for this question.