Secure S3 Access with VPC Endpoint and IAM Conditions

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

C Create a gateway endpoint for Amazon S3 and restrict access using an IAM policy with a Deny action based on the S3ResourceAccount condition key.

Question

A company hosts its application on several Amazon EC2 instances inside a VPC. The company creates a dedicated Amazon S3 bucket for each customer to store their relevant information in Amazon S3. The company wants to ensure that the application running on EC2 instances can securely access only the S3 buckets that belong to the company’s AWS account. Which solution will meet these requirements with the LEAST operational overhead?
  1. Create a gateway endpoint for Amazon S3 that is attached to the VPC. Update the IAM instance profile policy to provide access to only the specific buckets that the application needs.
  2. Create a NAT gateway in a public subnet with a security group that allows access to only Amazon S3. Update the route tables to use the NAT Gateway.
  3. Create a gateway endpoint for Amazon S3 that is attached to the VPUpdate the IAM instance profile policy with a Deny action and the following condition key: Correct Answer
  4. Create a NAT Gateway in a public subnet. Update route tables to use the NAT Gateway. Assign bucket policies for all buckets with a Deny action and the following condition key:

Key Takeaways

The core challenge is preventing cross-account bucket access while maintaining scalability; the trap is assuming explicit Allow lists are sufficient when Deny conditions are needed for external resources.

This question explores securing Amazon S3 access from EC2 instances using VPC Gateway Endpoints and IAM policy conditions to restrict access to specific AWS accounts.

Common mistake: Many candidates choose A, believing that listing specific buckets in an IAM policy is the simplest method, failing to account for the dynamic nature of per-customer buckets and the need to explicitly deny other accounts.

Expert Analysis

Why the Answer Is Correct

Option C is the correct answer because it combines a VPC Gateway Endpoint for secure, private connectivity with an IAM policy condition that explicitly denies access to any S3 resource not owned by the company's AWS account. The S3ResourceAccount condition key allows the policy to dynamically block access to buckets in other accounts without needing to list every single bucket ID, which would be operationally expensive as new customer buckets are created.

Why the Other Options Are Wrong

Option A fails because it relies on an explicit Allow list of bucket ARNs. Since the company creates a dedicated bucket for each customer, the number of buckets grows dynamically, making it impossible to maintain a static IAM policy that lists all valid buckets. Option B and D use NAT Gateways, which route traffic through the public internet, violating the requirement for least operational overhead and secure direct connectivity. Additionally, Option D uses a bucket policy, which is harder to manage at scale than an instance profile policy.

Community Comment Notes

Community members like toyaji noted that NAT gateways are for internet-facing outbound traffic and that listing buckets in Option A is impractical due to dynamic growth. LeonSauveterre emphasized that Option A does not explicitly ensure access is limited to buckets only owned by the company, highlighting the need for a Deny action against other accounts. Denise123 correctly identified that the StringNotEquals condition on S3ResourceAccount is the valid approach to restrict access to the company's own AWS account number.

Official Reference

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-resourceaccount

This link opens the official vendor documentation in a new tab.

Exam Strategy

When dealing with dynamic resources (like per-customer buckets), avoid options that require static lists of resource IDs. Instead, look for solutions that use conditions or attributes (like Account IDs) to define permissions broadly but securely.

Frequently Asked Questions

Why can't I just allow specific bucket ARNs in the IAM policy?

Because the scenario states there is a dedicated bucket for each customer, meaning the number of buckets is dynamic. Listing them all in an IAM policy would require constant updates and high operational overhead.

What is the benefit of using a VPC Gateway Endpoint over a NAT Gateway?

A VPC Gateway Endpoint provides a private connection to S3 within the AWS network, avoiding the cost and complexity of NAT Gateways and keeping traffic off the public internet.

More SAA-C03 FAQ →

Community Votes

C
70%
A
30%

70% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 11 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 11

  1. toyaji 👍 5 Answered C
    B, C is not secure way because NAT gateway is for internet-facing outbound. A is not correct because company will create dedicated bucket for each customers it means number of buckets will increase dynamically. so you cant list all on profile.
  2. Denise123 👍 3 Answered C
    The requirement in the question is to ensure that the EC2 instances can securely access only the S3 buckets that belong to (are owned by) the company's AWS account. In that context, using the "StringNotEquals": {"S3ResourceAccount":["CompanyAWSAcctNumber"]} condition key in the IAM instance profile policy is a valid approach. This condition key restricts access to S3 buckets that are not owned by the specified AWS account number (the company's account). By setting a Deny with this condition, it effectively allows access only to the S3 buckets owned by the company's AWS account.
  3. LeonSauveterre 👍 3 Answered C
    A - It doesn’t explicitly ensure that access is limited to buckets only owned by the company. We need further adjustments to enforce this restriction (like adding a Condition key). B & D - NAT gateways route traffic over the internet, so it's not so secure or cost-effective as S3 Gateway Endpoint. C - Use an S3 Gateway Endpoint and restrict access using an IAM policy with a condition to deny access to any S3 resource outside the company’s account. Simple, secure, and easy to understand.
  4. Bwhizzy 👍 3 Answered C
    Answer is C. Just specify only the company AWS account number, rather than listing all the Buckets
  5. AMEJack 👍 2 Answered A
    Option C will deny the other S3 buckets but will not Allow access to the specified Buckets, thus we should have Allow rules. Option A will allow the specified Buckets and implicit Deny the other buckets.
Show 6 more comments
  1. Denise123 👍 1 Answered A
    By choosing Option A, the company can leverage the simplicity and security of VPC Gateway Endpoints for Amazon S3, combined with IAM instance profile policies to grant selective access to the required S3 buckets. This solution provides the necessary isolation and access control with minimal operational overhead, making it the most efficient and scalable approach. Option C and other options have limitations or introduce additional operational overhead Option C (Creating a Gateway Endpoint and using a Deny policy with S3ResourceAccount condition) is not a valid approach. The S3ResourceAccount condition key is used to restrict access based on the AWS account that owns the S3 bucket, not the AWS account that is accessing the bucket.
  2. viejito 👍 1
    la respuesta correcta es la A :Los buckets son servicios globales.( o sea no están en una VPC ni Subnet ), entonces no hace falta que estén en una subred publica o privada ; los Nat Gateway son para redes publicas o privadas .Entonces ahí descarta B,C y D .Cuando quieres conectar un recurso de Global Service se usa Endpoint Gateway por eso la respuesta es A .
  3. EllenLiu 👍 1 Answered A
    answer C cannot restrict ec2 from accessing s3 from other accounts. Only by providing access to specific buckets in IAM policy on EC2 are we able to achieve this.
  4. trinh_le 👍 1 Answered A
    A. Allows option fits to minimum permission policy C. Deny action is complexity and hard to debug
  5. XXXXXlNN 👍 2
    Vote A
  6. youkarthik 👍 1 Answered A
    A as per gen AIs

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide