A media company's central data-lake bucket is shared by five application teams, each of which should be able to read and write only within its own prefix. Managing this with one large, constantly changing bucket policy has become error-prone as new teams are added. Which S3 feature lets an administrator create a separate named endpoint per team, each carrying its own access policy scoped to that team's prefix, without editing the underlying bucket policy every time?
- Configure S3 Cross-Region Replication so each team gets its own destination bucket
- Create IAM users with AdministratorAccess for each team and let them self-manage
- Create an S3 Access Point per team, each with a policy scoped to that team's prefix
- Keep adding a new statement to the bucket policy for each team's IAM role ARN
Why C? And why not the others?
Correct answer: C. Create an S3 Access Point per team, each with a policy scoped to that team's prefix
S3 Access Points are named network endpoints attached to a bucket, and each access point carries its own dedicated access policy, so a team can be granted access scoped to only its own prefix through its own endpoint without anyone touching the underlying bucket policy. This is exactly the problem access points solve: managing access to a large shared dataset at scale as the number of consumers grows. Replicating the bucket per team multiplies storage cost, still requires policy management on every copy, and does not scope access by prefix on a single dataset. Granting broad administrative permissions to every team violates least privilege and gives far more access than the stated requirement. Continually appending statements to one bucket policy is the unscalable pattern the company is trying to escape, and bucket policies are also capped at 20 KB, so that approach eventually stops working outright as more teams are onboarded.
Source: AWS S3 docs: Managing access to shared datasets with access points