DVA-C02 Security Practice Question
A company's S3 bucket policy includes a condition that uses 'aws:SourceIp' to restrict access to a specific IP range. However, requests from that IP range are still denied. What is a possible reason?
⚠ Common exam trap
A common mix-up: candidates assume 'aws:SourceIp' always reflects the client's original public IP, but they forget that VPC endpoints and proxies (like CloudFront or a NAT gateway) can change the source IP seen by the service, leading to unexpected denials.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The request is coming through a VPC endpoint, so the source IP is not the client's IP.
When a request is made through a VPC endpoint (specifically a Gateway Endpoint for S3), the source IP address seen by S3 is the private IP of the VPC endpoint, not the client's original public IP. The 'aws:SourceIp' condition key evaluates the IP address from which the request originates at the network layer, but VPC endpoints use private IPs from the VPC CIDR range, which will not match the public IP range specified in the policy. This causes the condition to fail and the request to be denied, even though the client is within the intended IP range.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The request is routed through CloudFront, which changes the source IP.
Why it's wrong here
CloudFront can be configured to use origin access identity, but the source IP condition would see CloudFront's IPs, not the client's; however, this would cause denial, but the question states the IP range is allowed.
- ✗
The bucket owner's IAM user policy overrides the bucket policy.
Why it's wrong here
AWS evaluates both identity-based (IAM user/role) policies and resource-based (S3 bucket) policies. For a request to be allowed, both policies must grant permission. If the S3 bucket policy contains an explicit deny based on the 'aws:SourceIp' condition, an allow statement in the IAM user policy will not override it, as an explicit deny always takes precedence. Therefore, the bucket policy's IP condition would still deny the request.
- ✓
The request is coming through a VPC endpoint, so the source IP is not the client's IP.
Why this is correct
When requests to S3 originate from within a VPC and are routed through a VPC endpoint for S3, the 'aws:SourceIp' condition key in the S3 bucket policy evaluates the private IP address of the VPC endpoint, not the original client's public IP address. Consequently, if the bucket policy's allowed IP range does not include the VPC endpoint's private IP, the request will be denied. To correctly permit access from a VPC endpoint, the 'aws:SourceVpce' condition key, specifying the VPC endpoint ID, should be used instead.
- ✗
The condition key 'aws:SourceIp' is misspelled.
Why it's wrong here
AWS condition keys are case-sensitive and must be spelled precisely as documented for proper evaluation. The condition key 'aws:SourceIp' is the correct and standard spelling used to evaluate the source IP address of a request. Assuming the policy is syntactically valid, a misspelling of this specific key is generally not the underlying issue if the policy is configured to use it, unless there's an explicit typo in the policy itself.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 724-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.