DEA-C01 Data Security and Governance Practice Question
A data engineer is configuring cross-account access so that an analytics AWS account can read objects from a data-lake S3 bucket in a producer account. The objects are encrypted with SSE-KMS using a customer managed key in the producer account. The engineer has already added a bucket policy granting s3:GetObject to the analytics account's IAM role. Reads still fail with AccessDenied. Which additional change is required?
⚠ Common exam trap
The trap here is assuming that a bucket policy granting s3:GetObject is enough for cross-account reads, when SSE-KMS also requires identity permissions and key-policy trust.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attach an IAM policy to the analytics role allowing kms:Decrypt and kms:DescribeKey, and update the KMS key policy to allow the analytics account role to use the key.
Reading SSE-KMS objects across accounts needs authorization on both sides: the identity must be allowed kms:Decrypt and the KMS key policy must trust that identity. A bucket policy granting s3:GetObject is necessary but not sufficient, because S3 calls KMS to unwrap the object's data key, and KMS independently evaluates its key policy. Both the identity policy and key policy must permit the analytics role.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add s3:GetObjectVersion to the analytics role's IAM policy and include the s3:ExistingObjectTag condition in the bucket policy.
Why it's wrong here
Version-level read permissions and tag conditions refine which objects can be fetched, but they do not address encryption authorization. The request already passes S3 authorization; it fails when S3 asks KMS to decrypt the object's data key. Adding version or tag conditions cannot cause KMS to allow the analytics role to use a key it is not trusted for, so the read still fails.
- ✗
Enable S3 Block Public Access on the data-lake bucket and re-run the cross-account read.
Why it's wrong here
Block Public Access settings control whether buckets or objects can be made public; they do not grant cross-account KMS permissions. The failing call is an authenticated s3:GetObject that is denied during KMS key unwrap, not a public-access denial. Enabling these settings may even restrict legitimate access but will never supply the missing kms:Decrypt permission or key-policy trust, so the AccessDenied persists.
- ✗
Change the bucket's default encryption to SSE-S3 so that cross-account readers no longer need KMS permissions.
Why it's wrong here
Changing default encryption only affects newly written objects; existing SSE-KMS objects remain encrypted with their original key. Even for new writes, this weakens the security posture and does not retroactively fix the denied reads. The scenario requires reading existing KMS-encrypted data, so switching defaults leaves the AccessDenied in place and abandons the customer managed key requirement.
- ✓
Attach an IAM policy to the analytics role allowing kms:Decrypt and kms:DescribeKey, and update the KMS key policy to allow the analytics account role to use the key.
Why this is correct
SSE-KMS decryption requires two independent grants: the caller's identity policy must allow kms:Decrypt (and typically kms:DescribeKey), and the KMS key policy must permit that principal to use the key. The bucket policy alone only authorizes the S3 object read. Because the key lives in the producer account, its key policy must explicitly trust the analytics account role, otherwise KMS denies the data key unwrap and S3 returns AccessDenied.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DEA-C01 question from scratch — 1,321 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.