SAA-C03 · Question #349
A company collects 10 GB of telemetry data every day from multiple devices. The company stores the data in an Amazon S3 bucket that is in a source data account. The company has hired several…
The correct answer is C. Configure cross-account access for the S3 bucket to the accounts that the agencies own. The most secure and least operationally intensive method is to configure cross-account access using resource-based policies on the S3 bucket. This allows trusted external AWS accounts (consulting agencies) to securely access the S3 data without the need to manage user…
Question
A company collects 10 GB of telemetry data every day from multiple devices. The company stores the data in an Amazon S3 bucket that is in a source data account. The company has hired several consulting agencies to analyze the company's data. Each agency has a unique AWS account. Each agency requires read access to the company's data. The company needs a secure solution to share the data from the source data account to the consulting agencies. Which solution will meet these requirements with the LEAST operational effort?
Options
- ASet up an Amazon CloudFront distribution. Use the S3 bucket as the origin.
- BMake the S3 bucket public for a limited time. Inform only the agencies that the bucket is publicly
- CConfigure cross-account access for the S3 bucket to the accounts that the agencies own.
- DSet up an IAM user for each agency in the source data account. Grant each agency IAM user
How the community answered
(42 responses)- A2% (1)
- B5% (2)
- C90% (38)
- D2% (1)
Explanation
The most secure and least operationally intensive method is to configure cross-account access using resource-based policies on the S3 bucket. This allows trusted external AWS accounts (consulting agencies) to securely access the S3 data without the need to manage user credentials or build additional infrastructure. Options A and B pose security risks. Option D increases operational complexity and violates least privilege by managing external users inside your AWS account.
Community Discussion
No community discussion yet for this question.