A company manages hundreds of AWS accounts centrally in an organization In AWS Organizations.
The company recently started to allow product teams to create and manage their own S3 access points in their accounts. The S3 access points can be accessed only within VPCs. not on the internet. What is the MOST operationally efficient way to enforce this requirement?

Question

A company manages hundreds of AWS accounts centrally in an organization In AWS Organizations.

The company recently started to allow product teams to create and manage their own S3 access points in their accounts. The S3 access points can be accessed only within VPCs. not on the internet. What is the MOST operationally efficient way to enforce this requirement?

Orry Meijer · Accepted Answer

Set the S3 access point resource policy to deny the s3CreateAccessPoint action unless the s3 AccessPointNetworkOrigin condition key evaluates to VPC.

Orry Meijer · Answer

Create an SCP at the root level in the organization to deny the s3: Create Access Point action unless the s3:AccessPointNetworkOrigin condition key evaluates to VPC.

Orry Meijer · Answer

Use AWS Cloud Formation StackSets to create a new IAM policy In each AWS account that allows the s3:CreateAccessPoint action only if the s3:AccessPointNetwofkOngm condition key evaluates to VPC.

Orry Meijer · Answer

Set the S3 bucket policy to deny the s3:CreateAccessPoint action unless the s3:AccessPointNetworkOngin condition key evaluates to VPC.

Question list

List of questions

Question 1

(0)

Question 2

(0)

Question 3

(0)

Question 4

(0)

Question 5

(0)

Question 6

(0)

Question 7

(0)

Question 8

(0)

Question 9

(0)

Question 10

(0)

Related questions

Question 879 - SAP-C01 discussion

Suggested answer: A

0 comments