Answer: Configure cross-account access for the S3 bucket to the accounts that the agencies own.

## Explanation **Correct Answer: C - Configure cross-account access for the S3 bucket to the accounts that the agencies own.** ### Why Option C is Correct: 1. **Security**: Cross-account access allows the company to grant specific read permissions to each agency's AWS account without making the bucket public or creating IAM users in the source account. 2. **Operational Efficiency**: Agencies can manage their own IAM users and permissions within their accounts, reducing administrative overhead for the company. 3. **Least Privilege**: The company can grant only the necessary read permissions to each agency's account. 4. **Scalability**: As agencies are added or removed, the company only needs to update bucket policies or IAM roles, not manage individual user accounts. ### Why Other Options are Incorrect: **Option A - Configure S3 global tables to replicate data for each agency:** - S3 Global Tables are for cross-region replication, not for sharing data with external agencies. - This would create unnecessary data duplication and costs. - Doesn't address access control requirements. **Option B - Make the S3 bucket public for a limited time:** - **Major security risk**: Public buckets expose data to anyone who discovers the bucket name. - Not compliant with security best practices. - Difficult to control and monitor access. - Doesn't provide audit trails for who accessed the data. **Option D - Set up an IAM user for each analyst in the source data account:** - **Poor operational efficiency**: The company would need to manage IAM users for all analysts across all agencies. - **Security concerns**: The company would need to manage credentials, MFA, and access policies for external users. - **Scalability issues**: As agencies and analysts change, the company would need to constantly update IAM users. - **Compliance challenges**: Harder to maintain audit trails and separation of duties. ### Best Practices Implemented by Option C: 1. **Cross-account IAM roles**: Create roles that agencies can assume from their accounts. 2. **Bucket policies**: Use S3 bucket policies to grant cross-account access. 3. **Resource-based policies**: Combine with IAM policies in agency accounts. 4. **AWS Organizations**: Can be used with Service Control Policies for additional governance. This approach follows AWS security best practices by maintaining proper access control, enabling auditability, and minimizing operational overhead for the data owner.

Author: LeetQuiz Editorial Team