Q10Design Secure Architectures
A company manages a data lake in an Amazon S3 bucket that many applications access. The S3 bucket has a unique prefix for each application. The company wants to restrict every application to its own prefix and provide granular control over the objects under each prefix. Which solution will meet these requirements with the **LEAST operational overhead**?
← → navigate · a answer
Community votes
Discussion · 9
6
Answer A
By creating separate access points for each application, you can enforce access controls specific to their respective prefixes while minimizing administrative complexity. This approach provides a clean separation of permissions and reduces the risk of misconfigurations.
Options B, C, and D are not as efficient or straightforward:
Option B (S3 Batch Operations) involves setting ACL permissions for each object individually, which can be cumbersome and time-consuming.
Option C (replicating objects to new S3 buckets) introduces additional buckets and replication rules, increasing management overhead.
Option D (replicating objects and creating dedicated S3 access points) adds unnecessary complexity by combining replication and access point creation.
A 4
https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-points-policies.html
4
I have 2 questions: Is a bacth process there to set ACL permissions. Secondly, they are asking with least operational overhead. Isnt A CORRECT?
A 3
Explanation:
S3 Access Points: These provide a way to manage access to shared data sets in Amazon S3. Each access point has a unique hostname and a policy that is specific to the use case, allowing for granular control over access to data.
Access Point Policies: These policies can be tailored to restrict access to specific prefixes within an S3 bucket, ensuring that each application only has access to its designated prefix.
2
However, answer B need to set ACL for each OBJECT inside each S3... and the Batch operation has to be executed where there another new object added to the S3. I am not sure the answer too : )
A 2
A. Create dedicated S3 access points and access point policies for each application.
A 2
"unique prefix for each application" hence access points. Also, ACL is not recommended by AWS.
B 2
Create an S3 Batch Operations job to set the ACL permissions for each object in the S3 bucket
1
Answer B
Taking into consideration that we have "numerous applications" (10,100,1000?) and we need meet requirements with the LEAST operational overhead I would go into authomatization of operations hence Batch Operations seems to be good choice.
https://aws.amazon.com/blogs/storage/updating-amazon-s3-object-acls-at-scale-with-s3-batch-operations/