A security team notices that an S3 bucket containing sensitive data is publicly accessible. The bucket policy is as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": "*",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::example-bucket/*"
}
]
}

Which step should be taken to secure the bucket while maintaining access for authorized users?

Question

A security team notices that an S3 bucket containing sensitive data is publicly accessible. The bucket policy is as follows:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*"
    }
  ]
}

Which step should be taken to secure the bucket while maintaining access for authorized users?

Accepted Answer

Delete the public bucket policy and attach a new policy that allows access only through a VPC Endpoint.. Deleting the public bucket policy and attaching a new policy that allows access only through a VPC Endpoint ensures that the bucket is not publicly accessible and only authorized users within the VPC can access it. Option A is incorrect because using AWS Config to block public access does not by itself grant authorized users access; additional configuration is needed. Option B is incorrect because creating an IAM role and assigning it to the bucket does not override the existing public bucket policy; the bucket remains publicly accessible. Option C is incorrect because adding a Deny statement for IP addresses outside the corporate network does not remove the existing Allow statement for all principals, and the Allow would still grant public access unless an explicit Deny overrides it, which is not guaranteed with this approach.

Answer

Use AWS Config to automatically block all public access.

Answer

Create an IAM role with S3 access and assign it to the bucket.

Answer

Add a Deny statement for any IP address outside the corporate network.

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

SCS-C02 Infrastructure Security Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question