A Security Engineer has discovered that, although encryption was enabled on the Amazon S3 bucket example bucket, anyone who has access to the bucket has the ability to retrieve the files. The Engineer wants to limit access to each IAM user can access an assigned folder only.
What should the Security Engineer do to achieve this?

Question

A Security Engineer has discovered that, although encryption was enabled on the Amazon S3 bucket example bucket, anyone who has access to the bucket has the ability to retrieve the files. The Engineer wants to limit access to each IAM user can access an assigned folder only.

What should the Security Engineer do to achieve this?

Dilip Kumar · Accepted Answer

Create a customer-managed CMK with a key policy granting “kms:Decrypt” based on the “${aws:username}” variable.

Dilip Kumar · Answer

Use envelope encryption with the AWS-managed CMK aws/s3.

Dilip Kumar · Answer

Create a customer-managed CMK for each user. Add each user as a key user in their corresponding key policy.

Dilip Kumar · Answer

Change the applicable IAM policy to grant S3 access to “Resource”:“arn:aws:s3:::examplebucket/${aws:username}/*”

Question list

List of questions

Question 1

(0)

Question 2

(0)

Question 3

(0)

Question 4

(0)

Question 5

(0)

Question 6

(0)

Question 7

(0)

Question 8

(0)

Question 9

(0)

Question 10

(0)

Related questions

Question 108 - SCS-C01 discussion

Suggested answer: B

0 comments