Which set of additional steps must the DevOps engineer take to meet the company’s requirements?
Modify the S3 bucket’s ACL to grant bucket-owner-read access to the uploading user’s IAM role. Create an IAM policy that grants s3:GetObject operations on the S3 bucket when aws:ResourceTag/DataClassification equals confidential, and s3:ExistingObjectTag/Owner equals ${aws:userid}. Attach the policy to the IAM roles for users who require access to the S3 bucket.
Modify the S3 bucket policy to allow the s3:GetObject action when aws:ResourceTag/DataClassification equals confidential, and s3:ExistingObjectTag/Owner equals ${aws:userid}. Create an IAM policy that grants s3:GetObject operations on the S3 bucket. Attach the policy to the IAM roles for users who require access to the S3 bucket.
Modify the S3 bucket policy to allow the s3:GetObject action when aws:ResourceTag/DataClassification equals confidential, and aws:RequesttTag/Owner equals ${aws:userid}. Create an IAM policy that grants s3:GetObject operations on the S3 bucket. Attach the policy to the IAM roles for users who require access to the S3 bucket.
Modify the S3 bucket’s ACL to grant authenticated-read access when aws:ResourceTag/DataClassification equals confidential, and s3:ExistingObjectTag/Owner equals ${aws:userid}. Create an IAM policy that grants s3:GetObject operations on the S3 bucket. Attach the policy to the IAM roles for users who require access to the S3 bucket.
Explanations:
The bucket’s ACL modification grants unnecessary permissions (bucket-owner-read) and the policy is incorrectly formulated for handling object-level access control. IAM policy should rely on object-level permissions based on tags, but ACL is not needed in this case.
The S3 bucket policy is correctly configured to enforce access based on object tags (DataClassification = confidential and Owner = user), and the IAM policy grants necessary permissions for accessing the objects with appropriate tag-based conditions.
The policy uses “aws/Owner” instead of “s3/Owner.” This is incorrect because “aws” is for request tags, not object tags, leading to improper access control.
Modifying the S3 bucket’s ACL to grant “authenticated-read” is not necessary for fine-grained access control based on object tags. IAM policy alone can handle the required access control effectively.
I surmise that the answer is:
Modify the S3 bucket policy to allow the s3:GetObject action when aws:ResourceTag/DataClassification equals confidential, and s3:ExistingObjectTag/Owner equals ${aws:userid}. Create an IAM policy that grants s3:GetObject operations on the S3 bucket. Attach the policy to the IAM roles for users who require access to the S3 bucket.