SCS-C02 · Question #452
A company needs to prevent Amazon S3 objects from being shared with IAM identities outside of the company's organization in AWS Organizations. A security engineer is creating and deploying an SCP to a
The correct answer is A. Deny the S3:* action with a Condition element that comprises an operator of StringNotEquals, a. To restrict access to Amazon S3 objects so that they are only accessible by IAM identities within the company's AWS Organization, the SCP should deny access to any S3:* action where the resource's organization ID (aws:ResourceOrgID) does not match the principal's organization ID
Question
A company needs to prevent Amazon S3 objects from being shared with IAM identities outside of the company's organization in AWS Organizations. A security engineer is creating and deploying an SCP to accomplish this goal. The company has enabled the S3 Block Public Access feature on all of its S3 buckets. What should the SCP do to meet these requirements?
Options
- ADeny the S3:* action with a Condition element that comprises an operator of StringNotEquals, a
- BDeny the S3:PutAccountPublicAccessBlock action with a Condition element that comprises an
- CAllow the S3:* action with a Condition element that comprises an operator of StringNotEquals, a
- DDeny the S3:* action with a Condition element that comprises an operator of StringLike, a key of
How the community answered
(18 responses)- A83% (15)
- B6% (1)
- C11% (2)
Explanation
To restrict access to Amazon S3 objects so that they are only accessible by IAM identities within the company's AWS Organization, the SCP should deny access to any S3:* action where the resource's organization ID (aws:ResourceOrgID) does not match the principal's organization ID (aws:PrincipalOrgID). Using StringNotEquals ensures that only IAM identities within the organization can access the S3 objects. If the resource and principal organization IDs are different, access will be denied.
Topics
Community Discussion
No community discussion yet for this question.