SCS-C03 — Frequently Asked Questions

Athena is right only after events age past 90 days into an S3 log archive, and it requires a configured trail plus a table definition — setup the scenario never mentions.

No. AWS Config tracks resource configuration changes and compliance, not a searchable per-principal history of API calls; CloudTrail Event History is the tool for that.

s3:GetObject is an object-level action, so its Resource must identify objects under the bucket; the bare bucket ARN covers bucket-level operations such as listing.

No. The failure is the Resource path for GetObject, so changing Principal and removing the Condition does not grant access to the objects.

IAM task roles give ECS microservices temporary AWS permissions, but they do not authenticate external web users. The question's ordered flow is specifically the user-login and token-validation chain.

No; Cognito user pools authenticate users and issue tokens, while the Lambda authorizer validates those tokens at API Gateway before requests reach the ECS microservices.

Long-term access keys are not MFA-authenticated, so aws:MultiFactorAuthPresent stays false and the deny applies. STS GetSessionToken returns temporary MFA-backed credentials.

It can shift enforcement to a role trust policy, but it changes the architecture and can weaken the original deny. Option B's GetSessionToken flow directly supplies MFA-authenticated CLI credentials.

Global services such as IAM, STS, Route 53 and CloudFront do not report a Region, so a plain region deny would block them and break sign-in and DNS for every account in the OU.

SCPs do not grant permissions; an Allow for eu-west-1 adds nothing beyond IAM. You must deny all other Regions so the restriction is actually enforced.

A bastion still needs SSH keys, an always-on inbound SSH path, and separate access for on-premises servers, so it conflicts with the no-key and isolation requirements.

Yes. The SSM Agent can be activated on on-premises servers as a managed instance, allowing IAM-controlled sessions without inbound ports or SSH keys.

EKS Protection analyzes Kubernetes audit logs for control-plane risks, while Runtime Monitoring observes container and node activity such as file access, process execution, and network connections.

Security Hub standards check configuration posture against EKS controls; they do not analyze EKS audit logs or generate runtime findings for OS, network, and file events.

IAM users are per-account and separate from IAM Identity Center users; disabling the management-account IAM user does not stop the compromised Identity Center user from signing in to other assigned accounts.

No. Logs Insights queries CloudWatch Logs log groups, not S3 objects; the organizational event data store is queried through CloudTrail Lake instead.

It only scans objects uploaded after the trigger is configured, ignores existing objects, and requires per-bucket event wiring and code maintenance — far more overhead than Macie automated discovery.

No. It uses intelligent sampling to evaluate buckets and objects on a schedule, which is why you then run targeted full classification jobs only on the buckets it flags as sensitive.

AWS RAM shares supported AWS resources, not CloudFormation templates. To distribute an approved template for repeated deployments, use a Service Catalog product in a shared portfolio.

End users launch the product from the portfolio but cannot modify the underlying CloudFormation template. Each launch creates a new S3 bucket with the approved secure settings.