SAA-C03 Q267 · Security

Question

A company hosts its application on several Amazon EC2 instances inside a VPC. The company creates a dedicated Amazon S3 bucket for each customer to store their relevant information in Amazon S3. The company wants to ensure that the application running on EC2 instances can securely access only the S3 buckets that belong to the company’s AWS account. Which solution will meet these requirements with the LEAST operational overhead?

Accepted Answer

This answer meets all requirements with least operational overhead:

**Requirement 1: Secure access to S3** — A **VPC Gateway Endpoint** for S3 keeps traffic within the AWS network (never traverses the public internet). This is the most secure and cost-effective way for EC2 instances in a VPC to reach S3.

**Requirement 2: Only S3 buckets belonging to the company's AWS account** — The IAM instance profile policy uses a **Deny action** with the condition key `aws:ResourceAccount`. This condition key checks the AWS account that *owns* the resource being accessed. By denying requests where `aws:ResourceAccount` does NOT equal the company's own account ID, the policy ensures EC2 instances can ONLY access S3 buckets in the company's account — regardless of how many buckets exist or are created

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips