A company using AWS Organizations requires that no Amazon S3 buckets in its production accounts should ever be deleted. What is the SIMPLEST approach the SysOps Administrator can take to ensure S3 buckets in those accounts can never be deleted?
A.
Set up MFA Delete on all the S3 buckets to prevent the buckets from being deleted.
B.
Use service control policies to deny the s3:DeleteBucket action on all buckets in production accounts.
C.
Create an IAM group that has an IAM policy to deny the s3:DeleteBucket action on all buckets in production accounts.
D.
Use AWS Shield to deny the s3:DeleteBucket action on the AWS account instead of all S3 buckets.
I agree. MFA delete is just another obstacle in deleting the bucket, but would still allow for deletion if the MFA details are in possession.
Correct answer is B
Service control policies (SCPs) are a feature of AWS Organizations that allow you to set fine-grained permissions and restrictions across multiple AWS accounts. By creating an SCP and attaching it to the production accounts, you can deny the specific action of deleting S3 buckets (s3:DeleteBucket). This prevents any user or role within the production accounts from deleting S3 buckets, ensuring the buckets remain intact.
Answer is B. MFA Delete only prevents accidental deletion, but you can still delete it. In the question, it asks that NOONE should be allowed to to delete the S3 bucket.
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
MrKhan
Highly Voted 2 years, 7 months agoAWSum1
2 years, 7 months agoalbert_kuo
Most Recent 9 months, 3 weeks agoRicardoD
2 years, 6 months agoabhishek_m_86
2 years, 6 months agojackdryan
2 years, 6 months agoMFDOOM
2 years, 6 months agotifoz
2 years, 6 months agoKhatriRocks
2 years, 6 months agoallsitesmember
2 years, 6 months agojpt2353
2 years, 7 months agoJichu
2 years, 7 months agoBad_Mat
2 years, 7 months agogretch
2 years, 7 months agosuba1234
2 years, 7 months ago