SAA-C03 Q328 · Security

Question

A company stores a file in an S3 bucket containing IP allow/deny lists. The file must be accessible via an HTTP endpoint. Firewalls outside AWS must read the file. The company wants to restrict access to only the firewall IP addresses. The S3 Block Public Access feature is enabled on the account. Which solution meets these requirements?

Accepted Answer

**Option B: Create a bucket policy that explicitly allows access only from the firewall IP addresses.**

This works because of a critical nuance in how **S3 Block Public Access** operates:

1. **S3 Block Public Access blocks *public* policies, not *all* policies.** AWS defines 'public' as policies that grant access to a wildcard principal (`*` or any authenticated user) without a restricting condition. A policy that allows access from **specific IP addresses** using `aws:SourceIp` condition is **NOT considered public** by AWS.

2. **The bucket policy uses an IP-based condition:**
```json
{
  "Effect": "Allow",
  "Principal": "*",
  "Action": "s3:GetObject",
  "Resource": "arn:aws:s3:::bucket-name/*",
  "Condition": {
    "IpAddress": {
      "aws:SourceIp": ["203.0.113.0/24"]
    }
  }
}
`

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips