A team stores customer documents in an S3 bucket. How would you secure it?
What the interviewer wants to hear
- Block Public Access at account and bucket level
- Least privilege bucket and IAM policies, enforce TLS
- Encryption at rest with SSE-KMS and key policy control
- Versioning, Object Lock or MFA delete, and lifecycle rules
- Logging and monitoring with CloudTrail data events, access logs, Macie or GuardDuty
- Private access through VPC endpoints and pre-signed URLs
Model answer
First I turn on S3 Block Public Access at both account and bucket level and keep Object Ownership set to bucket owner enforced, so ACLs are disabled. Access is granted through IAM roles and a bucket policy with least privilege, plus a condition that denies requests not using TLS. Data is encrypted with SSE-KMS using a customer managed key, so key policy adds a second layer of control and every use is logged. I enable versioning, and for compliance data Object Lock, to protect against deletion or ransomware. Applications reach the bucket through a VPC gateway endpoint, and the bucket policy can require that endpoint. Users download files through short-lived pre-signed URLs instead of public links. For visibility I enable CloudTrail data events, use Amazon Macie to find sensitive data, GuardDuty for threats, and lifecycle rules to delete data we no longer need.
Can you answer it under time pressure?
Take a timed medium round and get scored on every answer.
More medium Cloud Engineer questions
- Design a secure three-tier web application on AWS (or your preferred cloud). Walk through the network and services.
- How do you manage Terraform state and multiple environments (dev, staging, prod) safely?
- An instance in a private subnet cannot reach the internet to install packages. How do you troubleshoot it?
- How would you plan the migration of an on-premises application to the cloud?
- Describe how you would build a CI/CD pipeline for Terraform changes across dev, staging and production.
- A team wants to move a service onto your Kubernetes cluster. What do you check before calling it production ready?
- You are on call and p99 latency for a cloud API jumps from 200 ms to 3 seconds. Walk through how you investigate and handle it.
- How do you manage application secrets such as database passwords and API keys in a cloud environment?
- Design a tagging and cost allocation strategy for a company running many teams on AWS.