MLS-C01 · Question #265
A company's data engineer wants to use Amazon S3 to share datasets with data scientists. The data scientists work in three departments: Finance. Marketing, and Human Resources. Each department has…
The correct answer is C. Create a single S3 bucket that includes two folders to separate the sensitive datasets from the. The correct approach is to create a single S3 bucket with two folders: one for sensitive datasets and one for non-sensitive datasets. IAM bucket policies and/or folder-level policies are then applied so that only the Finance IAM user group has access to the sensitive folder…
Question
A company's data engineer wants to use Amazon S3 to share datasets with data scientists. The data scientists work in three departments: Finance. Marketing, and Human Resources. Each department has its own IAM user group. Some datasets contain sensitive information and should be accessed only by the data scientists from the Finance department. How can the data engineer set up access to meet these requirements?
Options
- ACreate an S3 bucket for each dataset. Create an ACL for each S3 bucket. For each S3 bucket
- BCreate an S3 bucket for each dataset. For each S3 bucket that contains a sensitive dataset, set
- CCreate a single S3 bucket that includes two folders to separate the sensitive datasets from the
- DCreate a single S3 bucket that includes two folders to separate the sensitive datasets from the
How the community answered
(20 responses)- A5% (1)
- B5% (1)
- C80% (16)
- D10% (2)
Explanation
The correct approach is to create a single S3 bucket with two folders: one for sensitive datasets and one for non-sensitive datasets. IAM bucket policies and/or folder-level policies are then applied so that only the Finance IAM user group has access to the sensitive folder, while all three groups (Finance, Marketing, Human Resources) can access the non-sensitive folder. This approach uses S3's key prefix-based access control through IAM policies, which allows fine-grained, folder-level permissions within a single bucket. Using S3 ACLs (Option A) is a legacy mechanism that is less flexible and not recommended for user-group-level access control. Creating separate buckets per dataset (Option B) adds unnecessary management overhead. A single bucket with proper IAM prefix-based policies (Option C) is the most manageable and scalable approach while meeting least-privilege requirements.
Topics
Community Discussion
No community discussion yet for this question.