AWS Certified Solutions Architect - Professional SAP-C02 — Topic 1 Question 306

Question

A research center is migrating to the AWS Cloud and has moved its on-premises 1 PB object storage to an Amazon S3 bucket. One hundred scientists are using this object storage to store their work-related documents. Each scientist has a personal folder on the object store. All the scientists are members of a single IAM user group. The research center's compliance officer is worried that scientists will be able to access each other's work. The research center has a strict obligation to report on which scientist accesses which documents. The team that is responsible for these reports has little AWS experience and wants a ready-to-use solution that minimizes operational overhead. Which combination of actions should a solutions architect take to meet these requirements? (Choose two.)

Accepted Answer

Correct answer: A, B. The correct answer is A, B. Option A: Create an identity policy that grants the user read and write access. Add a condition that specifies that the S3 paths must be prefixed with $(aws:username). Apply the policy on the scientists’ IAM user group. Option B: Configure a trail with AWS CloudTrail to capture all object-level events in the S3 bucket. Store the trail output in another S3 bucket. Use Amazon Athena to query the logs and generate reports. Amazon S3 provides durable, scalable object storage that is fully managed. Amazon Athena runs serverless SQL queries directly on data in Amazon S3 with no infrastructure to manage. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies.

AWS Certified Solutions Architect - Professional SAP-C02 — Question 306