As the IT administrator, you have been tasked with deploying a new StorageGRID system to...

The correct approach is to create three separate S3 tenant accounts, one for each business unit. StorageGRID tenant accounts are designed as administrative and data-isolation boundaries. NetApp states that each tenant account has its own federated or local groups, users, S3 buckets, and objects, allowing different organizational entities to manage their own resources independently. NetApp specifically cites an enterprise use case in which separate tenant accounts are created for different departments such as Marketing, Human Resources, and Customer Support.

This design also provides delegated administration. After the grid administrator creates each tenant, authorized users for that tenant can use Tenant Manager to manage their own groups, users, S3 access keys, and buckets without gaining administrative control over resources belonging to another tenant.

Option A can segregate S3 resources with bucket policies, and NetApp documents that as a valid alternative where separate tenants are unnecessary. However, it does not provide the same strict administrative separation required here. Options B and C similarly place all business units within one tenant and therefore share the same tenant-level administrative boundary.

Therefore, D best satisfies both strict isolation and independent management.

Reference topics: Tenant Accounts → Enterprise Multitenancy → Tenant Manager → Groups and Users → S3 Buckets → Administrative Isolation