A sensitive S3 prefix may be read only through a designated VPC endpoint.
Deny reads through another path even if a role is misused.
Which authentication approach is most appropriate?
Use an S3 bucket-policy Condition such as aws:SourceVpce in addition to IAM and endpoint policies.
Detailed explanation
Public permissions allow access from outside the VPC.
Public permissions allow access from outside the VPC.
Names are not evaluated as authorization conditions.
Names are not evaluated as authorization conditions.
CloudTrail does not evaluate or enforce access policies.
CloudTrail does not evaluate or enforce access policies.
The resource policy can deny access that does not arrive through the approved endpoint.
The resource policy can deny access that does not arrive through the approved endpoint.
Check official documentation
Compare the following points with the official documentation.
Amazon S3 bucket policy aws:SourceVpce、IAM global condition keys、VPC endpoint policyの公式説明を確認する。
What to confirm
名称による制御と、ポリシーConditionによる実アクセス制限を区別できる。
Key points
- SourceVpce
- Condition
- S3 bucket policy
- Layered control
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Explicit deny
A matching Deny overrides an Allow, so required administrative paths need deliberate exceptions.
Testing
Test approved, unapproved, and cross-account paths before enforcing the condition.