SAA-C03 Q534 · Networking

Question

A company operates multiple VPCs in a single AWS account. Account users need temporary access to Amazon S3 buckets. The S3 buckets are private and have no public endpoints. The solution must follow the principle of least privilege for access to each environment and must avoid distributing permanent access keys. Which solution will meet these requirements?

Accepted Answer

Option A satisfies every requirement systematically:

1. **Private access (no public endpoints)**: A Gateway VPC Endpoint for S3 creates a private route from the VPC to S3 without traversing the internet. Traffic stays entirely within the AWS network. This directly addresses the 'no public endpoints' requirement.

2. **Least privilege per environment**: Each VPC endpoint can have its own **endpoint policy** — a resource-based policy that controls which principals and which S3 buckets can be accessed through that specific endpoint. By scoping the policy to environment-specific IAM roles (e.g., only `role/dev-s3-access` can use the dev VPC's endpoint to reach `dev-bucket`), you achieve fine-grained, environment-scoped access.

3. **No permanent access keys**: The solution uses **IAM roles**,

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips