DVA-C02 Security Practice Question
A company wants to restrict access to an Amazon S3 bucket so that only requests originating from a specific Amazon VPC are allowed. The bucket is in the same AWS account as the VPC. Which configuration should the developer implement?
⚠ Common exam trap
Candidates often confuse `aws:SourceVpc` with `aws:SourceIp` or think a VPC Endpoint policy alone can restrict bucket access, but the bucket policy is the authoritative mechanism for inbound access control, while the endpoint policy governs outbound permissions from the VPC.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Bucket policy with condition aws:SourceVpc
The `aws:SourceVpc` condition key in an S3 bucket policy allows you to restrict access to requests originating from a specific VPC. This works in conjunction with a VPC endpoint for S3 (Gateway or Interface endpoint), which ensures that traffic from the VPC to S3 stays within the AWS network and does not traverse the public internet. The condition evaluates the VPC ID from which the request originates, providing a secure, network-level access control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Bucket policy with condition aws:SourceVpc
Why this is correct
The `aws:SourceVpc` condition key within an Amazon S3 bucket policy is the most direct and secure method to restrict access. This condition ensures that requests to the S3 bucket are permitted only if they originate from the specified Virtual Private Cloud (VPC) ID, effectively isolating access to resources within that particular network boundary. It leverages the inherent network context of the request, providing a robust and scalable solution without needing to manage individual IP addresses.
- ✗
Bucket policy with condition aws:SourceIp
Why it's wrong here
While an S3 bucket policy can utilize the `aws:SourceIp` condition to restrict access based on IP addresses, this approach is generally impractical and less reliable for an entire VPC. VPC IP address ranges can be dynamic, especially with services like NAT Gateways, AWS PrivateLink, or instances launched in different subnets. Accurately identifying and maintaining a comprehensive list of all potential source IP addresses within a VPC, including those from various AWS services, is complex, prone to errors, and difficult to manage, making it an inferior solution compared to `aws:SourceVpc`.
- ✗
Bucket ACL with VPC ID
Why it's wrong here
Amazon S3 Bucket Access Control Lists (ACLs) are a legacy access control mechanism that operates at a much coarser granularity than bucket policies. ACLs are primarily designed for granting basic read/write permissions to other AWS accounts or predefined S3 groups, and they do not support advanced conditions based on network attributes like a VPC ID. Therefore, using an S3 ACL to restrict access to a specific VPC is not technically possible, as this functionality is simply not available within the ACL framework.
- ✗
VPC Endpoint policy
Why it's wrong here
Incorrect. A VPC Endpoint policy controls what actions are allowed from the endpoint, but it does not restrict access to the bucket from other sources. Combining endpoint policy with bucket policy is possible, but the question asks for a single configuration to restrict to that VPC, and the bucket policy with aws:SourceVpc is the direct method.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 724 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.