DEA-C01 Data Security and Governance Practice Question
A data engineer is setting up cross-account access to an encrypted S3 bucket. The bucket uses a customer-managed KMS key. The engineer has configured the bucket policy and the IAM role in the source account. The target account still gets access denied errors when trying to read objects. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The KMS key policy does not grant the target account's IAM role the kms:Decrypt permission.
For cross-account access to an S3 bucket encrypted with a customer-managed KMS key, the KMS key policy must explicitly grant the target account's IAM role the kms:Decrypt permission. Without this, the target account will get access denied errors even if the bucket policy and IAM role are correctly configured. Option B is incorrect because Object Ownership does not affect cross-account read access. Option C is incorrect because the bucket policy only needs to allow the target account's IAM role, not the root user. Option D is incorrect because VPC Endpoint policies are not relevant to this cross-account access issue.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The KMS key policy does not grant the target account's IAM role the kms:Decrypt permission.
Why this is correct
S3 access to KMS-encrypted objects requires permissions on both the bucket policy and the KMS key policy. Because the key is customer-managed, its key policy must explicitly grant the target account's IAM role kms:Decrypt; otherwise KMS denies the request despite correct IAM and bucket configuration.
- ✗
The S3 bucket has Object Ownership set to BucketOwnerPreferred.
Why it's wrong here
Object Ownership governs who owns objects written to the bucket, affecting ACL-based access, not whether a cross-account principal can decrypt with a KMS key. It tempts because ownership settings do cause access failures, and would be correct if the denial involved object ACLs rather than KMS key policy permissions.
- ✗
The bucket policy does not allow the target account's root user.
Why it's wrong here
Cross-account access is granted to the assumed IAM role's principal, not the target account root user, so adding root-user permissions in the bucket policy does not resolve the denial. It tempts because root users appear in many policy examples, and would apply when the target account accesses directly without role assumption.
- ✗
The VPC Endpoint policy blocks access from the target account.
Why it's wrong here
A VPC endpoint policy restricts traffic traversing that endpoint only; it cannot cause access denied for requests arriving over the public S3 endpoint or from another network path. It tempts because endpoint policies do deny S3 access, and would be the cause if the target account's requests were routed through a restrictive endpoint.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,321 original DEA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.