DEA-C01 Practice Question 100: S3 Access Points Shared Lake
AWS Certified Data Engineer – Associate (DEA-C01) · Test 10 · question 10 of 10
A data lake bucket in Amazon S3 is shared by 40 teams, and each team must read and write only its own prefixes. Some teams must also be restricted so that their requests come only from a specific VPC. The single bucket policy that lists all of these permissions has grown so large that it is hard to review and is close to the size limit. The company wants to keep all data in one bucket and avoid copying it. Which approach should the data engineer use?
Show answer and explanation
Answer:
S3 access points *"simplify data access for any AWS service or customer application that stores data in S3."* AWS explains that *"each access point has distinct permissions and network controls,"* and that *"each endpoint enforces a customized access point policy that allow you to control use by resource, user, or other conditions."* An access point can also be configured *"to accept requests only from a virtual private cloud (VPC)."* Giving each team its own access point moves per-team rules out of the shared bucket policy, which then only needs to delegate access control to the access points, and the data stays in one bucket (option C).
- A is wrong because per-object ACLs are hard to audit at scale, and AWS recommends keeping ACLs disabled in favor of policies. - B is wrong because copying the data into 40 buckets contradicts the requirement to keep one bucket without copying. - D is wrong because long inline IAM policies for every user are just as hard to manage, and they cannot add the network restriction to a team's requests.
Reference: Managing access to shared datasets with access points