SAP-C02 Practice Question 42: Data Perimeter External Principals
AWS Certified Solutions Architect – Professional (SAP-C02) · Test 5 · question 2 of 10
A regulator has told a financial firm to prove that data held in Amazon S3 cannot be read by any identity outside the firm's own AWS organization. The firm has 150 member accounts and thousands of buckets, and application teams own their bucket policies. Two recent findings drove the mandate: a team granted s3:GetObject to a vendor's AWS account in a bucket policy, and another team briefly made a bucket world-readable during a debugging session.
The control must be preventive rather than detective, must apply to every existing and future bucket without any per-bucket configuration, must hold even when a bucket's own resource policy grants access to an outside principal, and must not break AWS services that access the buckets through service-linked roles.
What should the solutions architect implement?
Show answer and explanation
Answer:
Resource control policies are the organization policy type that sets the maximum available permissions on resources. AWS draws the distinction plainly: use an SCP to limit principals inside your member accounts, and use an RCP to restrict principals that are *external* to your organization when they request access to resources in your accounts. Amazon S3 is one of the services RCPs support. Because effective permissions are the intersection of the RCP with the identity-based and resource-based policies, a bucket policy that grants a vendor account access no longer results in access; AWS's own documentation uses precisely that example. Attaching the RCP at the organization root covers every member account and every bucket created later with no per-bucket work, and RCPs explicitly do not apply to calls made by service-linked roles, so AWS service access keeps working.
Option A addresses only half of what happened. Block Public Access stops anonymous and public access, but it does nothing about a bucket policy that names a specific external AWS account, which was the first finding.
Option B is the central misconception this question tests. A service control policy constrains only principals in the organization's own accounts; a principal in the vendor's account is not governed by the firm's SCPs at all, so the vendor's access continues.
Option C is detective and reactive. The bucket is exposed between the change and the remediation, the rule evaluates after the fact, and an automated policy rewrite can break a legitimate integration while still leaving a window of exposure.
Reference: Resource control policies (RCPs)