A data engineer attaches the above IAM policy to an IAM user. The user tries to download an object from my-bucket using the AWS CLI without specifying SSE headers. The object is stored with SSE-S3. Will the download succeed?
Exhibit
Refer to the exhibit.
```
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::my-bucket/*",
"Condition": {
"StringEquals": {
"s3:x-amz-server-side-encryption": "AES256"
}
}
}
]
}
```Trap 1: No, because the object is encrypted and the user does not have…
No, because the object is encrypted and the user does not have decrypt permission. — Actually, the user does have GetObject permission, and SSE-S3 decryption is automatic. The user does not need a separate decrypt permission for SSE-S3.
Trap 2: No, because the request does not include the required encryption…
No, because the request does not include the required encryption header. — This is incorrect because SSE-S3 does not require encryption headers on GET requests.
Trap 3: Yes, because the object is encrypted with SSE-S3, which uses AES256.
Yes, because the object is encrypted with SSE-S3, which uses AES256. — This is partially correct but not the direct reason; the key reason is that the policy allows GetObject, and SSE-S3 decryption is transparent.
- A
No, because the object is encrypted and the user does not have decrypt permission.
Why wrong: No, because the object is encrypted and the user does not have decrypt permission. — Actually, the user does have GetObject permission, and SSE-S3 decryption is automatic. The user does not need a separate decrypt permission for SSE-S3.
- B
No, because the request does not include the required encryption header.
Why wrong: No, because the request does not include the required encryption header. — This is incorrect because SSE-S3 does not require encryption headers on GET requests.
- C
Yes, because the object is encrypted with SSE-S3, which uses AES256.
Why wrong: Yes, because the object is encrypted with SSE-S3, which uses AES256. — This is partially correct but not the direct reason; the key reason is that the policy allows GetObject, and SSE-S3 decryption is transparent.
- D
Yes, because the policy allows s3:GetObject on the bucket.
Yes, because the policy allows s3:GetObject on the bucket. — This is correct. The IAM policy grants s3:GetObject, and since SSE-S3 objects can be retrieved without additional headers, the download succeeds.