SAA-C03 Q540 · Security

Question

A solutions architect needs to ensure that only resources in VPC vpc-11aabb22 can access an S3 bucket in account 123456789012 with Block Public Access enabled. Which solution meets this requirement?

Accepted Answer

**Option A** uses a **Deny + StringNotEquals** pattern, which is the standard IAM policy technique for "restrict access to only X."

**Step-by-step logic:**
1. **Requirement**: Only resources in `vpc-11aabb22` should access the bucket. All other sources must be blocked.
2. **Deny + NotEquals = Allow only the specified value**: The policy says "Deny all requests WHERE `aws:SourceVpc` is NOT equal to `vpc-11aabb22`." This effectively blocks every request that doesn't originate from that VPC.
3. **`aws:SourceVpc` condition key**: This global condition key evaluates the VPC ID from which a request is made. It works when traffic goes through a **VPC endpoint** (Gateway endpoint for S3). Requests from `vpc-11aabb22` via the VPC endpoint will have `aws:SourceVpc` = `vpc-11aabb22`, so the Deny doe

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips