A large company is using AWS Organizations to manage its multi-account AWS environment. According to company policy, all users should have read-level access to a particular Amazon S3 bucket in a central account. The S3 bucket data should not be available outside the organization. A SysOps administrator must set up the permissions and add a bucket policy to the S3 bucket. Which parameters should be specified to accomplish this in the MOST efficient manner?
A) Specify "*" as the principal and PrincipalOrgId as a condition.
B) Specify all account numbers as the principal.
C) Specify PrincipalOrgId as the principal.
D) Specify the organization's master account as the principal.

Question

Quizplus · Accepted Answer

The PrincipalOrgId condition key allows you to restrict access to the S3 bucket to only the accounts within the specified AWS Organization, ensuring that the data is not available outside the organization.

A Large Company Is Using AWS Organizations to Manage Its