Question

A data engineering team stores confidential financial datasets in an S3 bucket. Compliance requires that the data only be accessible from resources running inside the company's VPC, and never from the public internet or other AWS accounts, even if valid IAM credentials are presented. The team has already created a Gateway VPC endpoint for S3. Which approach enforces this requirement?

Accepted Answer

Add a bucket policy with a Deny statement on all S3 actions when the aws:sourceVpce condition key does not match the VPC endpoint ID.

Answer

Attach an IAM policy to each user that allows S3 access only from the corporate IP range using the aws:SourceIp condition.

Answer

Enable S3 Block Public Access on the bucket and rely on default account-level settings to restrict traffic to the VPC.

Answer

Enable default SSE-KMS encryption on the bucket and grant kms:Decrypt only to roles inside the VPC.