SAP-C02 Question 284

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• 1

  @duriselvan "the" access point which one bro.. all of them ? ==> hundreds of AWS accounts centrally in an organization in AWS Organizations. company recently started to allow product teams to create and manage their own S3 access points in their accounts. regarding Minimal impact? was that constraint perhaps from some other question ? MOST operationally efficient way to enforce this requirement Lastly Resource policies inherently apply to actions performed on a specific resource. To control the creation of a resource like an access point, a broader policy mechanism is needed.

• 1

  A. Set the S3 access point resource policy to deny the s3:CreateAccessPoint action unless the s3:AccessPointNetworkOrigin condition key evaluates to VPC. Here's why: Granularity: Enforcing the restriction within the access point resource policy itself offers the most granular control. It applies directly to the access point creation action, preventing unauthorized configuration at the source. Centralized management: Implementing the policy at the access point level allows for centralized management and avoids the need to manage individual IAM policies in each account. This simplifies operation and reduces maintenance overhead. Minimal impact: This approach doesn't require additional infrastructure or services like Service Control Policies (SCPs) or CloudFormation StackSets, minimizing setup and complexity.

• Chose B2

  As customer is using Organizations B is right.