Your company has many AWS accounts defined and all are managed via AWS Organizations. One AWS account has a S3 bucket that has critical data. How can we ensure that all the users in the AWS…

Question

Options

• AEnsure the bucket policy has a condition which involves aws:PrincipalOrglD
• BEnsure the bucket policy has a condition which involves aws:AccountNumber
• CEnsure the bucket policy has a condition which involves aws:PrincipaliD
• DEnsure the bucket policy has a condition which involves aws:OrglD

• A
  75% (18)
• B
  4% (1)
• C
  13% (3)
• D
  8% (2)

Explanation

The AWS Documentation mentions the following AWS Identity and Access Management (IAM) now makes it easier for you to control access to your AWS resources by using the AWS organization of IAM principals (users and roles). For some services, you grant permissions using resource-based policies to specify the accounts and principals that can access the resource and what actions they can perform on it. Now, you can use a new condition key, aws:PrincipalOrglD, in these policies to require all principals accessing the resource to be from an account in the Option B.C and D are invalid because the condition in the bucket policy has to mention aws:PrincipalOrglD https://aws.amazon.com/blogs/security/control-access-to-aws-resources-by-usins-the-aws- organization-of-iam-principal

No community discussion yet for this question.