CloudGuild · Blog · Cheat sheets · Lessons · Certifications
Understanding Access Control in AWS: A SAA-C03 Exam Question Walkthrough
Learn how to approach a key AWS exam question on fine-grained access control. Discover the best answer and why others fall short.
When it comes to AWS certification, candidates often trip over questions regarding access control. These concepts can be tricky, especially when fine-grained access is essential for sensitive data. Let’s break down one such question.
The question
A financial services company needs to store sensitive customer information while ensuring that access is tightly controlled and audited. They want to use AWS services that provide fine-grained access control. Which of the following options is the best choice?
A. Amazon S3 with IAM policies
B. Amazon DynamoDB with fine-grained access control
C. AWS Lambda with IAM roles
D. Amazon RDS with security groups
Think before you scroll
Before choosing an answer, consider the specific needs outlined in the question. Fine-grained access control is key here. Evaluate how each service manages permissions and access to sensitive data.
The answer
The correct option is B. Amazon DynamoDB with fine-grained access control. DynamoDB supports fine-grained access control through its IAM policies, allowing permissions to be set at the item and attribute level, which is vital for sensitive customer information.
Why the other options lose
A. Amazon S3 with IAM policies: While S3 can control access using IAM policies, it does not provide the same level of granularity as DynamoDB. S3 permissions are typically at the bucket or object level, making it less suitable for fine-grained control over specific data fields.
C. AWS Lambda with IAM roles: Lambda manages execution permissions through IAM roles, but it does not directly control access to data. This option does not meet the requirement for fine-grained access control over sensitive information.
D. Amazon RDS with security groups: RDS security groups manage access at the network level, defining which IP addresses and ports can communicate with the database. However, this does not address fine-grained access control for specific data within the database, making it inadequate for the scenario described.
The concept behind it
Fine-grained access control is about setting permissions at a more detailed level than just the resource as a whole. In AWS, services like DynamoDB excel at this by allowing you to define permissions on individual items and attributes. Understanding how each AWS service handles access control is critical for designing secure architectures.
Exam trap to remember
Remember: DynamoDB is the go-to for fine-grained access control. Always look for options that allow you to manage permissions at the most granular level when sensitive data is involved.