Examkin

Soru

Zorluk: OrtaIdentity and Access Management (IAM)

A company wants to share a dataset stored in an Amazon S3 bucket with a partner organization's AWS account. The company wants to grant this access by attaching a policy directly to the S3 bucket itself, specifying who can access it. Which type of policy should the company use to meet these requirements?

  1. A
    Identity-based policy
  2. B
    Security Group rule
  3. Resource-based policyCevap
  4. D
    Service Control Policy (SCP)

Cevap

Resource-based policy
A resource-based policy, such as an Amazon S3 bucket policy, is attached directly to the resource itself. It allows the owner of the resource to specify which principals (including users, roles, or other AWS accounts) have permission to access that specific resource.

Adım Adım Çözüm

1
Identify where the permissions policy needs to be attached according to the scenario.
The scenario requires the policy to be attached directly to the S3 bucket (which is a resource) rather than an IAM user or role.
This establishes that the solution requires a resource-level control mechanism.
2
Determine which AWS policy type is designed to be attached directly to resources and support cross-account principals.
Resource-based policies (such as S3 bucket policies) meet this requirement by directly identifying external AWS account IDs in the 'Principal' element.
This confirms that a resource-based policy is the correct mechanism for this resource-sharing scenario.

Anahtar Kavram

Resource-based policies are attached directly to AWS resources (like S3 buckets or KMS keys) and define which principals (including external AWS accounts) can access that resource.
Bu soruyu puanla

Konular

Identity and Access Management (IAM)

Bu konudan daha fazla soru