Question

A DevOps engineer is developing a photo-sharing website that lets users upload photos and view photos shared by other users. Users upload photos to an Amazon S3 bucket by using presigned URLs. The DevOps engineer must ensure that photos are scanned for malware before the website makes the photos available to other users. Which combination of steps meets these requirements? (Choose two.)

Accepted Answer

B. Create a bucket policy for the S3 bucket. Update the IAM role that the website uses to restrict access to uploaded photos by using tag-based access control (TBAC).; E. Enable Amazon GuardDuty Malware Protection for S3 with object tagging.

Answer

Enable Amazon GuardDuty S3 Protection. Create an AWS Lambda function to process S3 Protection findings and block access to any referenced objects.

Answer

Create a resource-based policy for the S3 bucket. Restrict access to uploaded photos by using the aws:SecureTransport condition key.

Answer

Enable Amazon Macie. Create an AWS Lambda function to process Macie findings and delete any referenced objects that contain malware.