Question

During a compliance audit, a security engineer discovers that an object storage bucket containing customer PII is accessible to anyone on the internet because its access control policy grants read permissions to all principals. The organization must remain compliant with data protection regulations while keeping the data available to an internal analytics application running in the same cloud account. Which action BEST remediates the exposure while preserving required functionality?

Accepted Answer

Remove the public access grant and apply a bucket policy that allows access only to the analytics application's IAM role, while enabling account-level public access blocking

Answer

Enable default server-side encryption on the bucket and leave the existing access policy unchanged

Answer

Move the bucket to a private subnet and attach a network security group that denies inbound internet traffic

Answer

Enable object versioning and access logging so that any unauthorized reads can be investigated after the fact