DEA-C01 Data Security and Governance Practice Question
A data engineer needs to share a dataset stored in Amazon S3 with another AWS account. The bucket policy currently grants access only to the owning account. What is the simplest way to grant cross-account access?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a bucket policy that grants access to the other account's IAM role
The simplest way to grant cross-account access to an S3 bucket is to add a bucket policy that specifies the other AWS account's IAM role as the principal. This allows the role to access the bucket without requiring additional setup in the target account. Option B (public-read ACL) would make the data publicly accessible, which is not secure and not recommended for cross-account sharing. Option C (using an ACL) is less flexible and does not support granting access to specific IAM roles across accounts. Option D (creating an IAM role in the other account) is unnecessary because the bucket policy can directly grant access to the other account's role.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Add a bucket policy that grants access to the other account's IAM role
Why this is correct
A bucket policy can specify a principal from another account.
- ✗
Set the object ACL to public-read
Why it's wrong here
This would make the object publicly accessible, not secure.
- ✗
Use an S3 access control list (ACL) to grant access to the other account
Why it's wrong here
ACLs are legacy and less secure; bucket policy is preferred.
- ✗
Create an IAM role in the other account and attach a policy to it
Why it's wrong here
The bucket policy must also allow access; this is not sufficient alone.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DEA-C01 question is part of Courseiva's 1,711-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.