A processing role in another account writes to the incoming prefix.
Deny other prefixes and delete operations.
Which authorization approach is most appropriate?
Use an S3 resource policy that limits Principal, Resource, Action, and relevant Conditions.
Detailed explanation
An audit event does not grant write access.
An audit event does not grant write access.
The role and incoming/* PutObject scope are enforced at the resource boundary.
The role and incoming/* PutObject scope are enforced at the resource boundary.
Unneeded reads, deletes, and prefixes become available.
Unneeded reads, deletes, and prefixes become available.
The bucket lacks a resource-side boundary.
The bucket lacks a resource-side boundary.
Check official documentation
Compare the following points with the official documentation.
Amazon S3 bucket policies、cross-account access、Object Ownershipの公式説明を確認する。
What to confirm
IAM側だけの許可とリソースポリシーによる境界の違いを説明できる。
Key points
- Resource policy
- Principal
- Prefix
- Cross-account
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Two-sided permission
Cross-account access requires compatible caller and resource-side permissions.
Object ownership
Use an ownership model that avoids ambiguous ACL control after external writes.