DEA-C01 Data Security and Governance Practice Question

A company wants to grant read-only access to an S3 bucket for a data analyst. The analyst should be able to list objects and read object content. Which IAM policy effect and action combination is correct?

⚠ Common exam trap

DEA-C01 often tests the distinction between s3:ListBucket and s3:ListAllMyBuckets; candidates might confuse the two, leading to incorrect policies.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Effect: Allow, Actions: s3:ListBucket, s3:GetObject

To grant read-only access to an S3 bucket, the policy must allow s3:ListBucket to list objects in the bucket and s3:GetObject to read object content. These actions are the minimum required for read-only access to a specific bucket.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Effect: Allow, Actions: s3:GetObject, s3:DeleteObject
Why it's wrong here
Granting s3:DeleteObject exceeds the read-only requirement, so the analyst could remove objects despite the stated scope. It is tempting because s3:GetObject alone covers object retrieval, and pairing it with a write action mirrors common full-access policies. For a role genuinely needing object deletion alongside reads, this combination would be valid.
✗
Effect: Allow, Actions: s3:ListAllMyBuckets, s3:GetObject
Why it's wrong here
Granting s3:ListAllMyBuckets permits listing every bucket in the account, not the objects within the specified bucket, so the analyst cannot enumerate its contents. It is tempting because s3:ListAllMyBuckets is the account-level listing action, which would be correct for a policy allowing a user to discover which buckets exist before selecting one.
✗
Effect: Allow, Actions: s3:PutObject, s3:GetObject
Why it's wrong here
Granting s3:PutObject permits uploads, which exceeds the read-only requirement; the analyst only needs s3:GetObject plus s3:ListBucket for listing. It is tempting because GetObject alone appears insufficient for object access, and PutObject would be correct where an analyst must write results back to the bucket.
✓
Effect: Allow, Actions: s3:ListBucket, s3:GetObject
Why this is correct
ListBucket operates on the bucket resource and GetObject on the object resource, so both actions are required for listing and reading. An Allow effect grants the analyst read-only access without write permissions, matching the least-privilege requirement for listing objects and retrieving their content.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

DEA-C01 Data Security and Governance Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question