Examkin

Question

Difficulty: MediumShared Responsibility Model

A healthcare provider uses Amazon Simple Storage Service (Amazon S3) to store encrypted patient records. During a security audit, it is discovered that a bucket policy was improperly configured, allowing public read access to the records. Under the AWS Shared Responsibility Model, which of the following statements correctly identifies the party responsible for this configuration error and the reason?

  1. A
    AWS is responsible, because Amazon S3 is a managed service where AWS automatically handles all access control lists and bucket permissions.
  2. The customer is responsible, because they are responsible for configuring data access control, bucket policies, and identity management in the cloud.Answer
  3. C
    The customer is responsible, because they must configure Network Access Control Lists (NACLs) at the subnet level to block public traffic to individual S3 objects.
  4. D
    AWS is responsible, because they are required to audit all customer S3 bucket policies and publish these reports in AWS Artifact.

Answer

The customer is responsible, because they are responsible for configuring data access control, bucket policies, and identity management in the cloud.
The correct answer states that the customer is responsible for configuring access control, bucket policies, and identity management. S3 is a managed object storage service, but under the AWS Shared Responsibility Model, the customer is always responsible for data access permissions and configuration (security 'in' the cloud).

Step-by-Step Solution

1
Analyze the service type and resource configuration described in the scenario.
The scenario involves Amazon S3 bucket policy configuration, which controls access to data stored in S3.
Identifying the resource and setting helps determine where it falls under the Shared Responsibility Model.
2
Determine the boundary between security 'of' the cloud and security 'in' the cloud.
AWS manages security 'of' the cloud (infrastructure, physical security, virtualization layer). The customer manages security 'in' the cloud (data classification, identity and access management, and configuration of resource policies).
Differentiating these boundaries shows that configuring S3 bucket access policies is a customer responsibility.

Key Concept

Under the AWS Shared Responsibility Model, customers are responsible for configuring access controls and bucket policies for data stored in Amazon S3 (security 'in' the cloud), while AWS manages the underlying storage infrastructure (security 'of' the cloud).
Rate this question

Topics

Shared Responsibility Model

More questions from this topic