Exam AWS Certified DevOps Engineer - Professional DOP-C02 topic 1 question 74 discussion

D is correct

--acl authenticated-read means any authenticated users can read the S3 bucket. We should remove it and configure the bucket policy to explicitly grant access

"--acl authenticated-read" means any authenticated users can read the S3 bucket. We should remove it and configure the bucket policy to explicitly grant access

D is the answer ACL-authenticated users: This refers to any user who has successfully authenticated with AWS credentials, including IAM users and federated users. It does not include anonymous users (public access). It's generally recommended to use bucket policies for access control in S3 rather than ACLs. Bucket policies offer more granular control and better security practices. You can achieve "acl-authenticated reads" access using a bucket policy as well.

`remove --acl authenticated-read` is required to fulfill the requirement.

B is correct: In the "buildspec.yml file", we see that there is "--acl authenticated-read". This allow all aws users who successfully authen to AWS can download the file. To restrict access, we need to modify ACL that only grant access to some specific users. Note that we should not use bucket policy because it will affect all ojbects in the bucket (that is why it is called BUCKET policy). We only need to restrict acess to an object, then ACL is the right choice. A is incorrect: Use use --acl public-read means we allow all user to access the object C and D: Use bucket policy, which is incorrect

D is correct