A CodeBuild project uploads artifacts to a shared S3 bucket. The buildspec post_build uses --acl authenticated-read, and now anyone with an AWS account can download the artifacts. What should the DevOps engineer do to prevent this?

The correct solution is to remove --acl authenticated-read from the postbuild command and implement a bucket policy. --acl authenticated-read grants read access to any user with an AWS account, which is the problem described. By removing this ACL, the objects will inherit the bucket's default permissions. A bucket policy can then be configured to explicitly grant read access only to the relevant AWS accounts, ensuring fine-grained control. Incorrect options: Using --acl public-read would make the objects publicly accessible, which is the opposite of the desired outcome. S3 does not support configuring a default ACL that defines a custom set of authenticated users; authenticated-read is a predefined group. While creating a bucket policy that grants read access to specific accounts is part of the solution, denying read access to without first removing the authenticated-read ACL on the objects would not fully resolve the issue, as the object-level ACL would still grant access.