AWS Certified Data Engineer Associate · Free Practice Question Medium
Question 16
A company stores sensitive documents in an Amazon S3 bucket. They need to ensure that these documents can only be accessed by requests originating from a specific range of IP addresses within their corporate network. The company wants to enforce this policy at the bucket level.
Which approach should the company use to restrict access to the S3 bucket based on the originating IP address?
-
A
Set up a Security Group attached to the S3 bucket to allow traffic only from the specified IP range.
-
B
Implement IAM user policies to restrict access to the S3 bucket based on the IP address.
-
C
Apply an S3 bucket policy that includes a condition to allow access only from the specified IP address range.
-
D
Use a Network Access Control List (NACL) to restrict access to the S3 bucket for the specific IP range.
Reveal correct answer
Correct answer: C
Explanation
The best way to accomplish this requirement is by using an Amazon S3 bucket policy with a specific condition. The bucket policy can enforce access restrictions based on the source IP address.
By adding a condition in the bucket policy, the company can specify the allowed IP address range, ensuring that only requests originating from their corporate network can access the sensitive documents in the S3 bucket.
This approach is effective for applying broad access rules at the bucket level, directly controlling access to the data stored in S3.
CORRECT: "Apply an S3 bucket policy that includes a condition to allow access only from the specified IP address range" is the correct answer (as explained above.)
INCORRECT: "Implement IAM user policies to restrict access to the S3 bucket based on the IP address" is incorrect.
While IAM user policies can restrict access based on IP address, they are more suitable for user-level permissions rather than enforcing network-level restrictions for an entire S3 bucket.
INCORRECT: "Use a Network Access Control List (NACL) to restrict access to the S3 bucket for the specific IP range" is incorrect.
NACLs are used at the subnet level within a VPC and cannot be directly applied to an S3 bucket. They are not the correct method for controlling access to S3 resources based on source IP.
INCORRECT: "Set up a Security Group attached to the S3 bucket to allow traffic only from the specified IP range" is incorrect.
Security Groups are used to control inbound and outbound traffic for AWS resources like EC2 instances, but they cannot be directly attached to or enforce policies on S3 buckets.
References:
https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies.html
Save time with our AWS cheat sheets:
https://digitalcloud.training/aws-certified-data-engineer-associate-cheat-sheet/
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
