Exam AWS Certified Developer - Associate DVA-C02 topic 1 question 152 discussion

I don't think any of the options is correct. Seriously StringNotEquals not StringEquals?

C works as well but It is a broad solution I think it's better practice to use D and specify the exact endpoints that the user can access from. "aws:sourceVpce": ["vpce-id1", "vpce-id2", "..."]

{ "Version": "2012-10-17", "Statement": [ { "Sid": "DenyAccessIfNotFromSpecificVPCEndpoints", "Effect": "Deny", "Principal": "*", "Action": "s3:*", "Resource": [ "arn:aws:s3:::your-bucket-name", "arn:aws:s3:::your-bucket-name/*" ], "Condition": { "StringNotEquals": { "aws:SourceVpce": [ "vpce-0123456789abcdef0", "vpce-0fedcba9876543210", "vpce-0a1b2c3d4e5f6a7b8" ] } } } ] }

D is the correct answer.

https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies-vpc-endpoint.html typically explained the same scenario. D beyond doubt.

D, based on the following documentation: https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies-vpc-endpoint.html#example-bucket-policies-restrict-accesss-vpc-endpoint

Why it's StringNotEquals instead of StringEquals? Is the question wrong or my English is too bad to understand this?

This option is the closest to being correct, but it should use StringEquals instead of StringNotEquals. The correct approach is to use a single S3 bucket policy with a condition that includes aws:SourceVpce with StringEquals for the specific VPC endpoint IDs. This will ensure that access is allowed only from those specified endpoints.

https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies-vpc-endpoint.html#example-bucket-policies-restrict-access-vpc

D is correct

in option C : Condition": { "StringNotEqualsIfExists": { "aws:sourceVpce": "vpce*", } } it might Deny access from all VPC endpoints. so the ans is D

The correct answer is (C). Solution (C) is the simplest and will meet the company's requirements. It creates a single S3 bucket policy that has the value aws:SourceVpce and the StringNotEquals condition to use vpce*. This will only allow users who are using a VPC endpoint in the same VPC to access the S3 bucket.