A company shares Amazon SageMaker Studio notebooks that are accessible through a VPN. The company must enforce access controls to prevent malicious actors from exploiting presigned URLs to access…

Question

Options

• ASet up Studio client IP validation by using the aws:sourceIp IAM policy condition.
• BSet up Studio client VPC validation by using the aws:sourceVpc IAM policy condition.
• CSet up Studio client role endpoint validation by using the aws:PrimaryTag IAM policy condition.
• DSet up Studio client user endpoint validation by using the aws:PrincipalTag IAM policy condition.

• A
  76% (19)
• B
  8% (2)
• C
  12% (3)
• D
  4% (1)

Explanation

Option A is correct because aws:sourceIp restricts which IP addresses can use a presigned URL. Since access is via VPN, valid users connect from known VPN IP ranges. Even if a malicious actor steals a presigned URL, they cannot use it from an IP outside those allowed ranges - the IAM policy condition blocks the request at evaluation time.

Option B is wrong because aws:sourceVpc validates that requests originate from a specific VPC via a VPC endpoint. This scenario uses a VPN, not a VPC endpoint, so this condition wouldn't apply to the traffic path being described.

Option C is wrong because aws:PrimaryTag is not a real IAM global condition key - it's a fabricated distractor. No such condition exists in AWS IAM.

Option D is wrong because aws:PrincipalTag evaluates tags attached to the IAM principal (user or role) making the request. It controls who can act, not where from, so it doesn't prevent a stolen presigned URL from being used by someone at a different location.

Memory tip: Think "VPN = IP-based trust." A presigned URL is like a signed check - anyone who has it can try to cash it. aws:sourceIp is the bouncer who checks your ID (IP) before honoring it, making the VPN the gatekeeper.

No community discussion yet for this question.