Identifying Non-Versioned S3 Buckets Across Regions

SAA-C03 By islever Editorial Last updated

Determine appropriate data security controls.

Short answer

A Use Amazon S3 Storage Lens to identify all S3 buckets that are not versioning-enabled across Regions.

Question

A global company runs its workloads on AWS. The company's application uses Amazon S3 buckets across AWS Regions for sensitive data storage and analysis. The company stores millions of objects in multiple S3 buckets daily. The company wants to identify all S3 buckets that are not versioning-enabled. Which solution will meet these requirements?
  1. Use Amazon S3 Storage Lens to identify all S3 buckets that are not versioning-enabled across Regions. Correct Answer
  2. Enable IAM Access Analyzer for S3 to identify all S3 buckets that are not versioning-enabled across Regions.
  3. Create an S3 Multi-Region Access Point to identify all S3 buckets that are not versioning-enabled across Regions.

Key Takeaways

The core trap is confusing Storage Lens (metrics/analytics) with IAM Access Analyzer (security/policy findings); the correct solution requires a service capable of aggregating configuration state data.

This question addresses how to monitor Amazon S3 bucket configurations, specifically versioning status, across multiple AWS regions using native monitoring services.

Common mistake: Candidates often select IAM Access Analyzer because it sounds like a security compliance tool, failing to realize it only analyzes access policies, not object storage settings like versioning.

Expert Analysis

Why the Answer Is Correct

Based on standard AWS certification logic for this specific scenario, the correct answer is A (Amazon S3 Storage Lens). Although the source key suggests B and votes favor B, this is widely regarded as an error in the exam dump. S3 Storage Lens provides organization-wide or account-wide views of S3 usage metrics and activity trends. Its dashboard includes specific insights into bucket configurations, including whether versioning is enabled. It is the only option listed that aggregates operational metadata across regions.

Why the Other Options Are Wrong

Option B, IAM Access Analyzer for S3, is designed to identify public access or external access risks by analyzing bucket policies and ACLs. It does not inspect bucket properties such as versioning, encryption, or lifecycle rules. Option C, S3 Multi-Region Access Point, is a feature for unified access to buckets in different regions but does not provide a reporting or auditing mechanism for configuration status.

Community Comment Notes

Community feedback highlights significant confusion due to missing options. As user JoseAntonioPolo noted, "S3 Storage Lens" is the intended answer, referencing official blogs. Comments from users like LeonSauveterre and sandordini point out that the original question likely had a fourth option involving AWS Config or simply mislabeled Storage Lens. The consensus among experienced learners is that Storage Lens is the correct tool for visibility into bucket health and configuration states.

Official Reference

https://docs.aws.amazon.com/AmazonS3/latest/userguide/storage-lens.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When asked about 'visibility', 'analytics', or 'configuration status' across regions, prioritize S3 Storage Lens over IAM Access Analyzer. Remember: Access Analyzer = Policy/Security; Storage Lens = Metrics/Configuration Overview.

Frequently Asked Questions

Why is IAM Access Analyzer incorrect here?

IAM Access Analyzer only evaluates bucket policies and ACLs for unauthorized access risks. It cannot check bucket properties like versioning.

What if AWS Config was an option?

AWS Config would also be a valid answer for auditing configuration compliance, but between Storage Lens and Access Analyzer, only Storage Lens reports on versioning status.

More SAA-C03 FAQ →

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

  1. joseantoniopolo 👍 10 Answered B
    https://aws.amazon.com/blogs/aws/s3-storage-lens/
  2. LeonSauveterre 👍 3 Answered B
    FYI, the missing Option A: Set up an AWS CloudTrail event that has a rule to identify all S3 buckets that are not versioning-enabled across Regions. A - CloudTrail is meant for audit logs, not for analyzing bucket configurations directly. B - Storage Lens can provide an overview of all S3 buckets and their versioning status across Regions. Those built-in features that can directly tackle your problems should be your top preferences. C - IAM Access Analyzer is designed for access management, not storage configuration analysis. D - S3 Multi-Region Access Points allow applications to access S3 buckets across Regions using a single global endpoint. So not relevant as well.
  3. sandordini 👍 2
    Correct answer: A A: You can use an AWS Config managed rule to identify Amazon S3 buckets that do not have versioning enabled.
  4. nadeerm 👍 1 Answered B
    Answer is B Option A: Set up an AWS CloudTrail event that has a rule to identify all S3 buckets that are not versioning-enabled across Regions.
  5. xBUGx 👍 2
    where is option A?
Show 1 more comment
  1. Awsbeginner87 👍 2
    Where is option A

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide