A company stores confidential records in an Amazon S3 bucket and has discovered that engineers occasionally attach object ACLs and bucket policies that risk exposing data publicly. The security team wants two independent, durable guardrails: one that prevents any ACL or policy from making objects in this bucket public, and one that gives ongoing assurance by reporting whenever a bucket policy grants access to a principal outside the account. Which two measures together meet these requirements? Select TWO.
- ATurn on S3 Versioning for the bucket so that previous versions of objects are retained whenever an object is overwritten or deleted by an engineer.
- BEnable S3 Block Public Access at the bucket level so that public ACLs and public bucket policies are ignored and cannot expose objects. Correct
- CEnable IAM Access Analyzer for the account so it continuously evaluates resource policies and reports access granted to external principals. Correct
- DEnable default SSE-KMS encryption on the bucket so that every object is encrypted at rest with a customer managed key.
- EConfigure an S3 Lifecycle rule to transition objects to S3 Glacier Deep Archive after 30 days to reduce storage cost.
Why A is wrong: Versioning protects against overwrite and deletion, but it does nothing to block public access or report external grants.
Why B is correct: Block Public Access overrides public ACLs and public bucket policy grants, so no engineer setting can expose the objects.
Why C is correct: Access Analyzer continuously parses resource policies and surfaces external-access findings, giving the required ongoing assurance.
Why D is wrong: Default encryption protects data at rest but does not prevent public exposure or detect cross-account policy grants.
Why E is wrong: Lifecycle transitions manage storage cost and tiering, which is unrelated to blocking public access or reporting external grants.