District file uploads land under s3://bucket/{tenantId}/... and IAM policies must ensure a principal can only access its own tenant prefix. Which pattern supports enforceable isolation?
Select an answer to reveal the explanation.
Short Explanation
Folders named by tenantId are only as strong as the IAM bouncer checking the path. Put objects under /{tenantId}/ and condition policies so principals cannot wander into a neighbor's prefix.
Full Explanation
Multi-tenant S3 layouts pair tenant-scoped key prefixes with IAM or session policies that constrain s3:prefix (or equivalent) to the caller's tenantId. Shared prefixes with public ACLs, dropping bucket policies, or trusting overwritable metadata tags alone do not enforce server-side tenant isolation for uploads.