SAA-C03 - Design Secure Architectures - Section 1.9

Determine appropriate data security controls including S3 access controls, data classification and lifecycle protection.

Describe S3 Block Public Access settings as an account-level and bucket-level safeguard against accidental public exposure, and explain how Amazon Macie automates data classification to identify sensitive content such as personally identifiable information. Apply backup and retention controls appropriate to a data classification tier, and select lifecycle rules that move objects between storage classes or expire them based on age.

S3 Block Public AccessData classificationAmazon MacieBackup and retention

Practice question for this objective

Free sampleDesign Secure Architecturesmedium

A company stores confidential records in an Amazon S3 bucket and has discovered that engineers occasionally attach object ACLs and bucket policies that risk exposing data publicly. The security team wants two independent, durable guardrails: one that prevents any ACL or policy from making objects in this bucket public, and one that gives ongoing assurance by reporting whenever a bucket policy grants access to a principal outside the account. Which two measures together meet these requirements? Select TWO.

  • ATurn on S3 Versioning for the bucket so that previous versions of objects are retained whenever an object is overwritten or deleted by an engineer.
  • BEnable S3 Block Public Access at the bucket level so that public ACLs and public bucket policies are ignored and cannot expose objects. Correct
  • CEnable IAM Access Analyzer for the account so it continuously evaluates resource policies and reports access granted to external principals. Correct
  • DEnable default SSE-KMS encryption on the bucket so that every object is encrypted at rest with a customer managed key.
  • EConfigure an S3 Lifecycle rule to transition objects to S3 Glacier Deep Archive after 30 days to reduce storage cost.
Combine S3 Block Public Access to prevent public exposure with IAM Access Analyzer to continuously report resource policies that grant external access. Block Public Access neutralises any public ACL or bucket policy at the account or bucket level, while IAM Access Analyzer continuously evaluates resource-based policies and raises findings whenever access is granted to a principal outside the account or organisation. Together they form a preventive control plus a detective control, which is what the two stated requirements ask for.

Why A is wrong: Versioning protects against overwrite and deletion, but it does nothing to block public access or report external grants.

Why B is correct: Block Public Access overrides public ACLs and public bucket policy grants, so no engineer setting can expose the objects.

Why C is correct: Access Analyzer continuously parses resource policies and surfaces external-access findings, giving the required ongoing assurance.

Why D is wrong: Default encryption protects data at rest but does not prevent public exposure or detect cross-account policy grants.

Why E is wrong: Lifecycle transitions manage storage cost and tiering, which is unrelated to blocking public access or reporting external grants.

See more SAA-C03 practice questions, answers explained.

More in this domain

Back to all Design Secure Architectures objectives, or the SAA-C03 cert hub.

Examworthy is not affiliated with or endorsed by Amazon Web Services. Original, blueprint-aligned practice material only.