SAA-C03 · Question #723
A company must give a small group of auditors read-only access to an Amazon S3 bucket that stores sensitive audit logs. The auditors will review the logs once each month. The company has provisioned…
The correct answer is B. Create an IAM role with read-only S3 bucket access. Include a condition that allows auditors. Creating an IAM role with read-only access and allowing auditors to assume it during the review period provides temporary, automatically rotating credentials. This approach ensures the bucket remains private, access expires after the review, and all actions are logged in…
Question
A company must give a small group of auditors read-only access to an Amazon S3 bucket that stores sensitive audit logs. The auditors will review the logs once each month. The company has provisioned an IAM user for each auditor. The company must use the following specifications:
- The bucket remains private to the account
- Credentials are temporary and rotate automatically
- Access expires at the end of the monthly review period
- All activity is traceable to individual users in AWS CloudTrail
Which solution will meet these requirements?
Options
- AGenerate pre-signed URLs for the required objects that expire at the end of the review period.
- BCreate an IAM role with read-only S3 bucket access. Include a condition that allows auditors
- CAdd each auditor's IAM user to the bucket ACL with Read permissions. Remove each auditor's
- DEnable S3 static website hosting. Restrict access to each auditor's corporate IP address range by
How the community answered
(31 responses)- A10% (3)
- B42% (13)
- C19% (6)
- D29% (9)
Explanation
Creating an IAM role with read-only access and allowing auditors to assume it during the review period provides temporary, automatically rotating credentials. This approach ensures the bucket remains private, access expires after the review, and all actions are logged in CloudTrail under individual user identities.
Community Discussion
No community discussion yet for this question.