Exercise 3: Why an Account-Level Override Beats Per-Bucket Discipline — Possible Solution ==================================================================== Relying on every engineer to correctly configure each individual bucket's own access settings has a real, structural weakness: it only takes ONE mistake, on ONE bucket, made by ONE person, at any point in that bucket's own lifetime, to expose data publicly -- exactly the kind of real, human-error-driven misconfiguration behind the 2017 Deep Root Analytics leak. As the real number of buckets, engineers, and changes over time grows, the odds of at least one such mistake slipping through only increase. S3 Block Public Access, applied at the account level, works differently: it is a real, centralized setting that can override individual bucket-level policies, meaning a single, deliberate decision (enabling it account-wide) protects every bucket in that account by default, including buckets created later by engineers who might not even know this safeguard exists. Rather than requiring every individual configuration to be correct, it requires only one correct configuration, enforced centrally, that then applies broadly. ANSWER: An account-level override is meaningfully stronger because it removes the dependency on every single engineer getting every single bucket's own settings right, every time, indefinitely. It converts a problem that scales with the NUMBER of buckets and people involved into one that's solved once, centrally, and then applies automatically going forward -- directly closing the exact kind of gap that let the Deep Root Analytics data sit exposed. WHY THIS WORKS AS AN ANSWER ------------------------------ This correctly identifies the real structural advantage of a centralized, default-on safeguard over relying on distributed human discipline -- the same general security principle (defense that doesn't depend on every individual action being correct) that also motivated IMDSv2's own design in Chapter 3, applied here to a different real AWS service.