Exam AWS Certified Solutions Architect - Professional topic 1 question 727 discussion

Agreed, A is correct. C could be correct except for the part about restricting access using a bucket policy with aws:SourceIp which leaves A. See https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html#vpc-endpoints-s3-bucket-policies

Answer: A https://docs.aws.amazon.com/organizations/latest/userguide/orgs_permissions_overview.html the administrator in the management account can create a role to grant cross-account permissions to a user in a member account as follows: The management account administrator creates an IAM role and attaches a permissions policy to the role that grants permissions to the organization's resources. The management account administrator attaches a trust policy to the role that identifies the member account ID as the Principal who can assume the role. The member account administrator can then delegate permissions to assume the role to any users in the member account. Doing this allows users in the member account to create or access resources in the management account and the organization. The principal in the trust policy can also be an AWS service principal if you want to grant permissions to an AWS service to assume the role.

C could have been correct if aws:VpcSourceIp was mentioned instead of aws:SourceIp https://repost.aws/knowledge-center/block-s3-traffic-vpc-ip

C almost looks right, although you would use Aws:sourceip in a bucket policy when accessing it via internet. Use sourcevpc or sourcevpce when using an interface/gateway endpoint.

https://docs.aws.amazon.com/cost-management/latest/userguide/ce-api-best-practices.html An IAM user must be granted explicit permission to query the Cost Explorer API. Granting an IAM user access to the Cost Explorer API gives that user query access to any cost and usage data available to that account. B

answer is A - but still lambda would need to run in VPC for it to be able to use the Gateway endpoint, that part is missing.

C has interface endpoint which is incorrect for S3.

Agree with A. Gateway endpoint for S3.

A is correct, S3 gateway endpoint for access within analytics VPC from analytics application. https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints.html

It's A

AAA --- The cost of the AWS Organization is visible in the master account so B & D are out. A is a more best practice approach. No need for an interface endpoint

AAA --- The cost of the AWS Organization is visible in the master account so B & D are out. A is a more best practice approach. No need for an interface endpoint

A for sure

It is D. In A, the Lambda does not have permissions to write in the S3 bucket because it is not able to access the endpoint

agreed A is correct cause S3 supported only Gateway and DynamoDB endpoints https://docs.aws.amazon.com/vpc/latest/privatelink/vpce-gateway.html

going for A

I'll go with A