DVA-C02 Development with AWS Services Practice Question
A company has a Lambda function that writes to an S3 bucket. The IAM role used by the function has an inline policy allowing s3:PutObject on the bucket. However, writes fail with an access denied error. What is the MOST likely cause?
⚠ Common exam trap
Many candidates assume IAM permissions alone are sufficient and overlook that S3 bucket policies can explicitly deny access, which overrides any IAM allow due to AWS's explicit deny precedence.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The S3 bucket has a bucket policy that denies the request.
Even if the Lambda function's IAM role grants s3:PutObject, an explicit deny in the S3 bucket policy takes precedence over any allow. The access denied error indicates that the request is being evaluated and denied by the bucket policy, which overrides the IAM permission due to AWS's policy evaluation logic (explicit deny > allow).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The S3 bucket is in a different region.
Why it's wrong here
Cross-region access to S3 buckets is generally permitted by default, provided the requesting identity has the necessary IAM permissions. S3 buckets are global resources in terms of their unique naming, but data is stored regionally. An "Access Denied" error typically indicates an authorization failure based on policies, not a geographical connectivity or visibility issue between regions. Therefore, the bucket's region alone would not cause this specific error.
- ✗
The S3 bucket uses SSE-KMS encryption and the function lacks kms:Decrypt permissions.
Why it's wrong here
While missing KMS permissions can certainly cause issues when interacting with encrypted objects, the resulting error message would typically be more specific, such as "KMS access denied" or an encryption-related error, rather than a generic S3 "Access Denied" for the PutObject operation itself. A direct S3 "Access Denied" implies the S3 service rejected the request based on its own access policies before or independently of a KMS decryption attempt.
- ✗
The Lambda function does not have the correct execution role.
Why it's wrong here
The problem statement explicitly notes that the Lambda's execution role *does* include an inline policy allowing s3:PutObject. This means the identity-based permissions for the Lambda function are correctly configured to permit the action. Therefore, the "Access Denied" error must stem from another layer of authorization, specifically a policy applied directly to the S3 resource itself, which can override the identity's permissions.
- ✓
The S3 bucket has a bucket policy that denies the request.
Why this is correct
This is the correct explanation because AWS IAM policy evaluation logic dictates that an explicit Deny in any applicable policy always overrides an Allow. Even if the Lambda function's execution role has an Allow statement for s3:PutObject, an explicit Deny statement within the S3 bucket policy will take precedence, resulting in an "Access Denied" error for the request. This mechanism allows resource owners to enforce strict access controls.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 724-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.