A company has a new S3 bucket that stores very sensitive files. These objects are supposed to be used only by IAM admin user. Other IAM users or roles should not have access. Users in other AWS accounts cannot assume any role in reading the S3 objects either. You plan to use the S3 bucket policy to apply the security rules. Which option is the most secure one? 

Answer options:

A.{ "Version": "2012-10-17",
 "Statement": [{
 "Effect": "Allow",
 "Principal": {"AWS": [
 "arn:aws:iam::444455556666:user/Admin",
 "arn:aws:iam::444455556666:root" ]},
"Action": "s3:*",
"Resource": [
"arn:aws:s3:::BUCKETNAME",
"arn:aws:s3:::BUCKETNAME/*" ]
}]
}
B.{ "Version": "2012-10-17",
 "Statement": [{
 "Effect": "Deny",
 "NotPrincipal": {"AWS": [
 "arn:aws:iam::444455556666:user/Admin",
 "arn:aws:iam::444455556666:root" ]},
 "Action": "s3:*",
 "Resource": [
 "arn:aws:s3:::BUCKETNAME",
 "arn:aws:s3:::BUCKETNAME/*" ]
}]
}
C.{ "Version": "2012-10-17",
 "Statement": [{
 "Effect": "Allow",
 "NotPrincipal": {"AWS": [
 "arn:aws:iam::444455556666:user/User1",
 "arn:aws:iam::444455556666:user/User2",
 …
 "arn:aws:iam::444455556666:user/UserX" ]},
 "Action": "s3:*",
 "Resource": [
 "arn:aws:s3:::BUCKETNAME",
 "arn:aws:s3:::BUCKETNAME/*" ]
}]
}
D.{ "Version": "2012-10-17",
 "Statement": [{
 "Effect": "Deny",
 "Principal": {"AWS": [
 "arn:aws:iam::444455556666:user/User1",
 "arn:aws:iam::444455556666:user/User2",
 …
 "arn:aws:iam::444455556666:user/UserX" ]},
"Action": "s3:*",
"Resource": [
"arn:aws:s3:::BUCKETNAME",
"arn:aws:s3:::BUCKETNAME/*" ]
}]
}

Correct Answer – B
Explicit deny should be considered as it takes the highest priority even if the action is explicitly allowed somewhere else. Options A and C are eliminated. For option D, it is not realistic to list all users and roles to deny the action. The only option left is option
B. About how to use NotPrincipal, refer to https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_notprincipal.html.
Option A is incorrect because other users can access the bucket as well if they have an Allow in their IAM policies. Explicit deny should be used.
Option B is CORRECT With the policy, only the user Admin and root can access the bucket objects. Other IAM entities are denied.
Option C is incorrect because it is unsuitable to use Allow with NotPrincipal. Any IAM users or roles which are not in the NotPrincipal list can access the objects.
Option D is incorrect because you have to list all IAM users and roles in the Principal list, which is not appropriate.