A security team wants an S3 bucket policy with two statements: one that denies any request not made over HTTPS, and a separate one that denies any request originating outside the company's known corporate IP range, regardless of which IAM identity makes the request. Which condition keys should these two statements use, respectively?
- aws:MultiFactorAuthPresent for the HTTPS requirement, and aws:PrincipalOrgID for the IP-range requirement
- aws:SecureTransport for the HTTPS requirement, and aws:SourceIp for the IP-range requirement
- aws:SourceIp for the HTTPS requirement, and aws:SecureTransport for the IP-range requirement
- aws:CurrentTime for the HTTPS requirement, and aws:UserAgent for the IP-range requirement
Why B? And why not the others?
Correct answer: B. aws:SecureTransport for the HTTPS requirement, and aws:SourceIp for the IP-range requirement
aws:SecureTransport is a boolean condition key that reflects whether a request was made over SSL/TLS, so a statement can deny any request where this key is false to enforce HTTPS; aws:SourceIp evaluates the requester's IP address against a CIDR range, so a statement can deny any request whose source falls outside the corporate range. The option pairing MFA presence with organization membership is wrong because aws:MultiFactorAuthPresent only reflects whether MFA was used at authentication and has nothing to do with transport encryption, and aws:PrincipalOrgID restricts by AWS Organization membership rather than by any IP address range. The option that swaps the two correct keys is wrong because aws:SourceIp carries no information about whether a connection used HTTPS, and aws:SecureTransport carries no IP address information at all. The option pairing current time with user agent is wrong because aws:CurrentTime restricts access by date and time and aws:UserAgent inspects a client-supplied header, neither of which relates to transport encryption or the source network.
Source: AWS Identity and Access Management documentation: AWS global condition context keys (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html)