A company using AWS Organizations requires that no Amazon S3 buckets in its production accounts should ever be deleted. What is the SIMPLEST approach the SysOps administrator can take to ensure S3 buckets in those accounts can never be deleted?

Question

Jorge Diaz · Accepted Answer

Use service control policies to deny the s3:DeleteBucket action on all buckets in production accounts.

Jorge Diaz · Answer

Set up MFA Delete on all the S3 buckets to prevent the buckets from being deleted.

Jorge Diaz · Answer

Create an IAM group that has an IAM policy to deny the s3:DeleteBucket action on all buckets in production accounts.

Jorge Diaz · Answer

Use AWS Shield to deny the s3:DeleteBucket action on the AWS account instead of all S3 buckets.

Question list

List of questions

Question 1

(0)

Question 2

(0)

Question 3

(0)

Question 4

(0)

Question 5

(0)

Question 6

(0)

Question 7

(0)

Question 8

(0)

Question 9

(0)

Question 10

(0)

Related questions

Question 6 - SOA-C02 discussion

Suggested answer: B

0 comments