SAP-C02 S3 Bucket Policies Practice Question

A company is designing a data lake on Amazon S3 for analytics. The data is ingested from multiple sources and must be encrypted at rest. The company requires the ability to audit access to the data lake and enforce fine-grained access control based on tags. Which solution should the company choose?

⚠ Common exam trap

A common trap is assuming that advanced services like AWS Lake Formation or S3 Object Lambda are required for tag-based access control, but S3 bucket policies with condition keys provide a simpler and more direct solution.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Use S3 bucket policies with condition keys for tags

The correct solution uses S3 bucket policies with condition keys based on tags. S3 bucket policies can use the `s3:ExistingObjectTag` condition key to enforce fine-grained access control based on object tags. Encryption at rest is achieved using S3's default encryption (SSE-S3) or other server-side encryption options, which are independent of the access control mechanism. AWS CloudTrail with S3 data events can audit all access requests, providing the required audit trail. This combination meets all requirements: encryption at rest, tag-based fine-grained access control, and auditing.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Use S3 bucket policies with condition keys for tags
Why this is correct
Correct. S3 bucket policies with condition keys (e.g., `s3:ExistingObjectTag`) can enforce tag-based access control. Combined with S3 default encryption and CloudTrail auditing, this meets all requirements.
✗
Use S3 server-side encryption with customer-provided keys (SSE-C) and bucket policies
Why it's wrong here
Incorrect. SSE-C provides encryption at rest but does not directly enable tag-based access control. While bucket policies can include tag conditions, the emphasis on SSE-C is irrelevant to access control.
✗
Use AWS Lake Formation with column-level permissions
Why it's wrong here
Incorrect. AWS Lake Formation provides column-level permissions and tag-based access control (LF-TBAC), but it is designed for governed tables and the AWS Glue Data Catalog. It is not the simplest or most direct solution for standard S3 bucket access control.
✗
Use S3 Object Lambda with AWS CloudTrail
Why it's wrong here
S3 Object Lambda processes data transformations on the fly, whereas tag-based access control requires AWS Lake Formation to enforce fine-grained permissions. While CloudTrail provides an audit trail for API calls, it cannot natively restrict data access based on object tags. This approach is useful when you need to redact sensitive information or resize images dynamically as they are retrieved from S3.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SAP-C02 S3 Bucket Policies Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question