CloudGuild · Blog · Cheat sheets · Lessons · Certifications
AWS Certified Security - Specialty Exam Question Walkthrough
Master the AWS Certified Security - Specialty exam with a detailed breakdown of a critical question about S3 bucket policies.
A common stumbling block for candidates is ensuring the correct configuration of S3 bucket policies. Misunderstanding how to prevent public access can lead to significant security risks.
The question
A security team is concerned about the exposure of sensitive data in their Amazon S3 buckets. They want to ensure that no data is publicly accessible. What should they do to verify that their S3 bucket policies are configured correctly?
A. Use the AWS Config service to check compliance.
B. Enable S3 Block Public Access settings.
C. Review bucket policies manually for public access permissions.
D. Use Amazon Macie to monitor and alert on sensitive data.
Think before you scroll
Consider the primary goal: preventing public access to S3 buckets. Each option presents a different approach to handling security, but only one directly addresses the need for immediate prevention.
The answer
The correct option is B. Enable S3 Block Public Access settings. This feature is designed specifically to prevent any public access to S3 buckets, making it the most effective choice for ensuring compliance with security policies.
Why the other options lose
A. Use the AWS Config service to check compliance.
While AWS Config can help check compliance with certain rules, it does not actively prevent public access. Compliance checks are useful but do not provide real-time security.
C. Review bucket policies manually for public access permissions.
Manual reviews can be time-consuming and prone to human error. This option does not offer a proactive solution to block public access.
D. Use Amazon Macie to monitor and alert on sensitive data.
Amazon Macie is useful for identifying sensitive data within S3, but it does not prevent public access. It’s a monitoring tool, not a security measure.
The concept behind it
To effectively secure S3 buckets, it is crucial to implement controls that prevent public access outright. The S3 Block Public Access settings provide a robust way to achieve this by automatically blocking any public access that might otherwise be granted through bucket policies or access control lists (ACLs).
Exam trap to remember
Always prioritize direct prevention methods over compliance checks or monitoring tools when securing data access.