CloudGuild · Blog · Cheat sheets · Lessons · Certifications
AWS Certified Solutions Architect - Associate: Exam Question Walkthrough
Explore a challenging question about data access and auditing in AWS. Understand the right choices and why others fall short.
When it comes to securing sensitive data in AWS, candidates often trip over the specifics of access control and auditing. The right answer isn't always obvious, especially with various options that seem viable at first glance.
The question
A company is deploying an application that requires access to sensitive data stored in Amazon S3. They want to ensure that only specific users can access this data and to keep a detailed audit trail of access requests. What is the best solution to implement?
- A. Use S3 bucket policies and enable server access logging.
- B. Use IAM policies and enable AWS CloudTrail.
- C. Use S3 object ACLs and enable Amazon CloudWatch.
- D. Use Amazon Macie for data discovery and enable AWS Config.
Think before you scroll
Consider both access control and auditing needs. Which options not only restrict access effectively but also provide a clear audit trail for monitoring access requests?
The answer
The best solutions are A and B. Option A uses S3 bucket policies, which allow for fine-grained control over access to specific users and groups. Enabling server access logging provides a detailed audit trail of who accessed what and when. Option B employs IAM policies, which also offer strong access control alongside AWS CloudTrail to track API calls and access attempts.
Why the other options lose
C. Use S3 object ACLs and enable Amazon CloudWatch. While S3 object ACLs can control access, they lack the flexibility of bucket policies. Moreover, Amazon CloudWatch is primarily for monitoring and does not provide audit trails for S3 access.
D. Use Amazon Macie for data discovery and enable AWS Config. Amazon Macie is focused on data discovery and classification, which is not directly related to controlling access. AWS Config tracks configuration changes but does not provide a direct method for auditing access requests.
The concept behind it
The principle here is managing access control while maintaining a detailed audit trail. Use IAM policies or S3 bucket policies for access control, and pair them with tools like AWS CloudTrail or server access logging to ensure you can track who accessed your data.
Exam trap to remember
Remember, when securing data, always consider both access control and audit logging. Choose options that satisfy both requirements for a complete solution.