A company has a development workload running in AWS Account A. Developers assume an IAM role named `DeveloperRole` in Account A to perform their tasks. The solutions architect needs to grant these developers access to an Amazon S3 bucket named `prod-data-archive` located in AWS Account B. The access must be restricted to requests originating from the corporate office IP range (). Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)
- In Account A, attach a policy to the `DeveloperRole` that allows the `s3:GetObject` and `s3:ListBucket` actions on the `prod-data-archive` bucket.Cevap
- In Account B, attach a bucket policy to the `prod-data-archive` bucket that grants the `s3:GetObject` and `s3:ListBucket` permissions to the `DeveloperRole` in Account A, with a condition that restricts access to the source IP range .Cevap
- CIn Account B, create individual IAM users with long-term access keys for each developer in Account A, and attach a policy allowing access to the `prod-data-archive` bucket.
- DIn Account B, use the AWS account root user to generate a pre-signed URL for the `prod-data-archive` bucket and share it with the developers.
- EIn Account B, configure a Network ACL on the subnet containing the S3 bucket to restrict inbound traffic to the corporate IP range .
Cevap
Attaching an IAM policy to the role in the source account to allow access to the bucket, and attaching a bucket policy in the destination account that grants access to that role under a condition restricting requests to the corporate IP range.
For cross-account S3 access, permissions must be enabled on both sides: the IAM role policy in the source account must allow outbound access to the bucket, and the S3 bucket policy in the destination account must allow inbound access from the role. The S3 bucket policy can use the `aws:SourceIp` condition to enforce that requests originate only from the corporate IP range.
Adım Adım Çözüm
Anahtar Kavram
Cross-account access to Amazon S3 requires permissions to be granted both on the IAM identity in the source account and on the S3 bucket policy in the target account.