DVA-C02 Question 152

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose D3

  { "Version": "2012-10-17", "Statement": [ { "Sid": "DenyAccessIfNotFromSpecificVPCEndpoints", "Effect": "Deny", "Principal": "*", "Action": "s3:*", "Resource": [ "arn:aws:s3:::your-bucket-name", "arn:aws:s3:::your-bucket-name/*" ], "Condition": { "StringNotEquals": { "aws:SourceVpce": [ "vpce-0123456789abcdef0", "vpce-0fedcba9876543210", "vpce-0a1b2c3d4e5f6a7b8" ] } } } ] }

• Chose D1

  D is the correct answer.

• 1

  for bucket policy, if vpce isnt explicitly allowed, it's by default denied anyway so it should have been allow string equal vpce?