Amazon Web Services AWS Certified Solutions Architect - Professional SAP-C02 Question # 24 Topic 3 Discussion
SAP-C02 Exam Topic 3 Question 24 Discussion:
Question #: 24
Topic #: 3
Question:
A company uses IAM Identity Center for data scientist access. Each user should be able to accessonly their own datain an S3 bucket. The company also needs to generatemonthly access reportsper user.
Options:
A.
Use IAM Identity Center permission sets to allow S3 access scoped to userName tag.
B.
Use a shared IAM Identity Center role for all users and bucket policy.
C.
Use AWS CloudTrail to log S3 data events, query via Athena.
D.
Use CloudTrail management events to CloudWatch, then use Athena.
A: Use dynamic IAM policies with {aws:PrincipalTag/userName} to enforceprefix-level access control— i.e., bucket/userA/*, bucket/userB/*.
C: Enable CloudTraildata eventsto capture object-level access andquery them withAthena. This is the AWS-recommended way to audit per-user object access.
Incorrect:
B doesn't provide user isolation.
D only capturesmanagement events, not object-level data access.
E is legacy, inefficient, and not structured for per-user auditing.
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit