SAP-C02 · Question #245
A company manages hundreds of AWS accounts centrally in an organization in AWS Organizations. The company recently started to allow product teams to create and manage their own S3 access points in the
The correct answer is B. Create an SCP at the root level in the organization to deny the s3:Create Access Point action. You can set up AWS SCPs to require any new Access Point in the organization to be restricted to VPC-Only type. This makes sure that any Access Point created in your organization provides access only from within the VPCs and there by firewalling your data to within your private ht
Question
A company manages hundreds of AWS accounts centrally in an organization in AWS Organizations. The company recently started to allow product teams to create and manage their own S3 access points in their accounts. The S3 access points can be accessed only within VPCs. not on the internet. What is the MOST operationally efficient way to enforce this requirement?
Options
- ASet the S3 access point resource policy to deny the s3:CreateAccessPoint action unless the s3
- BCreate an SCP at the root level in the organization to deny the s3:Create Access Point action
- CUse AWS Cloud Formation StackSets to create a new IAM policy. In each AWS account that
- DSet the S3 bucket policy to deny the s3:CreateAccessPoint action unless the
How the community answered
(38 responses)- A11% (4)
- B61% (23)
- C21% (8)
- D8% (3)
Explanation
You can set up AWS SCPs to require any new Access Point in the organization to be restricted to VPC-Only type. This makes sure that any Access Point created in your organization provides access only from within the VPCs and there by firewalling your data to within your private https://aws.amazon.com/blogs/storage/managing-amazon-s3-access-with-vpc-endpoints-and-s3-
Community Discussion
No community discussion yet for this question.