Question

A security engineer manages an S3 bucket that stores audit logs shared across an organization. The bucket resource-based policy must deny all access to the bucket EXCEPT for a specific cross-account IAM role (arn:aws:iam::222222222222:role/AuditReader) and the local account root. The engineer wants the deny to apply to every other principal, including future ones, without having to enumerate them. Which policy construct correctly implements this?

Accepted Answer

A statement with Effect Deny, Action s3:*, Resource the bucket and objects, and NotPrincipal listing the AuditReader role ARN and the account root ARN.

Answer

A statement with Effect Allow, Action s3:*, and Principal set to the AuditReader role, relying on the implicit deny for all other principals.

Answer

A statement with Effect Deny, Action s3:*, and Condition using aws:PrincipalArn with StringNotEquals matching only the AuditReader role ARN.

Answer

A statement with Effect Deny, Action s3:*, and NotPrincipal set to a wildcard '*' to exclude everyone but the AuditReader role.