Question

A financial services company allows developers to access a cloud object storage bucket containing sensitive customer records. Security requires that access to this bucket be permitted only when requests originate from the corporate VPN's public IP range, even for users who already hold valid credentials. Which approach best enforces this requirement?

Accepted Answer

Add a condition to the IAM policy that restricts access based on the source IP address range of the corporate VPN

Answer

Enable multi-factor authentication for all developer accounts accessing the bucket

Answer

Rotate the developers' access keys on a weekly schedule to limit credential exposure

Answer

Move the bucket into a private subnet and require SSH tunneling for all access