Question

A data analytics company stores a large shared dataset in a single S3 bucket that is accessed by many applications and teams. The bucket policy has grown to hundreds of statements and has become difficult to manage and audit. Security wants each application to access only its own prefix, using distinct network and identity controls, without a single unwieldy bucket policy. Which approach best meets these requirements?

Accepted Answer

Create a separate S3 Access Point for each application, each with its own access point policy scoped to the relevant prefix, and update applications to use the access point ARN.

Answer

Split the dataset into one bucket per application and grant each application full access to its own bucket via IAM policies.

Answer

Enable S3 Object Lock on the bucket and use retention modes to restrict which application can access each prefix.

Answer

Add an S3 bucket ACL for each application granting access to the corresponding prefix objects.