SCS-C02 · Question #95
A security engineer needs to configure an Amazon S3 bucket policy to restrict access to an S3 bucket that is named DOC-EXAMPLE-BUCKET. The policy must allow access to only DOC- EXAMPLE-BUCKET from onl
The correct answer is B. { "Statement": [ { "Sid": "Access-to-specific-VPCE-only", "Principal": "*", "Action": "s3:*", "Effect": "Deny", "Resource": [ "arn:aws:s3:::DOC-EXAMPLE-BUCKET", "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*" ], "Condition": { "StringNotEquals": { "aws:sourceVpce": "vpce-1a2b3c4d" } } } ] }. Option B is correct because it uses Effect: Deny combined with StringNotEquals on aws:sourceVpce. This means any request that does NOT come from vpce-1a2b3c4d will be explicitly denied, effectively blocking all access except through the specified VPC endpoint. In AWS IAM policy e
Question
A security engineer needs to configure an Amazon S3 bucket policy to restrict access to an S3 bucket that is named DOC-EXAMPLE-BUCKET. The policy must allow access to only DOC- EXAMPLE-BUCKET from only the following endpoint: vpce-1a2b3c4d. The policy must deny all access to DOC-EXAMPLE-BUCKET if the specified endpoint is not used. Which bucket policy statement meets these requirements? A. B. C. D.
Exhibits
Options
- A{ "Statement": [ { "Sid": "Access-to-specific-VPCE-only", "Principal": "", "Action": "s3:", "Effect": "Allow", "Resource": [ "arn:aws:s3:::DOC-EXAMPLE-BUCKET", "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*" ], "Condition": { "StringNotEquals": { "aws:sourceVpce": "vpce-1a2b3c4d" } } } ] }
- B{ "Statement": [ { "Sid": "Access-to-specific-VPCE-only", "Principal": "", "Action": "s3:", "Effect": "Deny", "Resource": [ "arn:aws:s3:::DOC-EXAMPLE-BUCKET", "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*" ], "Condition": { "StringNotEquals": { "aws:sourceVpce": "vpce-1a2b3c4d" } } } ] }
- C{ "Statement": [ { "Sid": "Access-to-specific-VPCE-only", "Principal": "", "Action": "s3:", "Effect": "Deny", "Resource": [ "arn:aws:s3:::DOC-EXAMPLE-BUCKET", "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*" ], "Condition": { "StringEquals": { "aws:sourceVpce": "vpce-1a2b3c4d" } } } ] }
- D{ "Statement": [ { "Sid": "Access-to-specific-VPCE-only", "Principal": "", "Action": "s3:", "Effect": "Allow", "Resource": [ "arn:aws:s3:::DOC-EXAMPLE-BUCKET", "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*" ], "Condition": { "StringEquals": { "aws:sourceVpce": "vpce-1a2b3c4d" } } } ] }
How the community answered
(49 responses)- A10% (5)
- B63% (31)
- C20% (10)
- D6% (3)
Explanation
Option B is correct because it uses Effect: Deny combined with StringNotEquals on aws:sourceVpce. This means any request that does NOT come from vpce-1a2b3c4d will be explicitly denied, effectively blocking all access except through the specified VPC endpoint. In AWS IAM policy evaluation, an explicit Deny always overrides any Allow, making this the most secure and correct approach to restrict bucket access exclusively to a single VPC endpoint.
Topics
Community Discussion
No community discussion yet for this question.