DVA-C02 Security Practice Question
A company uses AWS Organizations with multiple accounts. A developer needs to grant an IAM user in Account A (111111111111) read-only access to an S3 bucket in Account B (222222222222). The bucket is encrypted with SSE-S3. Which combination of policies is required for cross-account access?
⚠ Common exam trap
Test-takers frequently think only a bucket policy is needed for cross-account access, forgetting that the IAM user must also have an explicit allow in their own account's IAM policy to actually invoke the S3 API call.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Bucket policy in Account B granting s3:GetObject to the IAM user ARN, and an IAM policy in Account A allowing s3:GetObject.
Cross-account S3 access requires both a bucket policy in the resource account (Account B) that explicitly grants the IAM user ARN from Account A the s3:GetObject permission, and an IAM policy in the user's account (Account A) that allows the same action. The bucket policy acts as a resource-based policy that authorizes the cross-account principal, while the IAM policy is necessary to authorize the user to make the request. SSE-S3 encryption does not require additional configuration because S3 handles decryption automatically for authorized users.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Bucket policy in Account B granting s3:GetObject to the IAM user ARN, and an IAM policy in Account A allowing s3:GetObject.
Why this is correct
This combination correctly implements cross-account S3 access using the standard two-policy model. The bucket policy in Account B explicitly grants the `s3:GetObject` permission to the specific IAM user's ARN in Account A, acting as the resource-based policy. Concurrently, the IAM policy attached to the user in Account A allows that user to perform the `s3:GetObject` action, serving as the identity-based policy. Both policies must explicitly permit the action for access to be granted successfully.
- ✗
Bucket policy in Account B granting s3:GetObject to Account A's root user ARN, and an IAM policy in Account A allowing s3:GetObject.
Why it's wrong here
While granting `s3:GetObject` to Account A's root user ARN in the bucket policy could technically allow delegation, it violates the principle of least privilege and is a security anti-pattern. Granting access to the root user is overly broad, as it effectively grants access to the entire account, making it less secure and harder to audit than granting directly to a specific IAM user. Although an IAM policy in Account A would still be required for the specific user, the bucket policy's target is suboptimal and insecure.
- ✗
Bucket policy in Account B granting s3:GetObject to the IAM user ARN, and no IAM policy in Account A is needed.
Why it's wrong here
This option is incorrect because AWS requires both an identity-based policy and a resource-based policy to explicitly allow an action for cross-account access. Even if the bucket policy in Account B grants `s3:GetObject` to the IAM user's ARN, the IAM user in Account A must also have an attached IAM policy that permits them to perform the `s3:GetObject` action. Without the identity-based IAM policy, the user lacks the necessary permissions to initiate the action, resulting in an access denied error.
- ✗
IAM policy in Account A allowing s3:GetObject, and an S3 Access Point in Account B configured for cross-account access.
Why it's wrong here
An S3 Access Point in Account B can simplify access management, but this option describes an incomplete solution. While an IAM policy in Account A is necessary for the user, an S3 Access Point configured for cross-account access still requires a policy on the Access Point itself to grant access to the IAM user, and crucially, the underlying S3 bucket's policy must grant access to the Access Point. Simply stating an Access Point is 'configured for cross-account access' without detailing the full policy chain makes this combination insufficient on its own for complete access.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 724-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DVA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company manages multiple AWS accounts using AWS Organizations. A developer needs to allow an IAM role in the production account to read objects from an S3 bucket in the development account. The bucket is encrypted with an AWS KMS customer managed key (CMK) in the development account. Which of the following is required to enable this cross-account access?
medium- A.Grant the production account's root user access to the KMS key and the S3 bucket.
- ✓ B.Add a bucket policy allowing the production account's IAM role and a KMS key policy granting the same role.
- C.Create an IAM role in the production account with permissions to access the S3 bucket and KMS key.
- D.Enable S3 bucket logging to allow cross-account access.
Why B: Cross-account access to an S3 bucket encrypted with a KMS customer managed key requires both a bucket policy that grants the production account's IAM role s3:GetObject permission and a KMS key policy that grants the same role kms:Decrypt permission. The bucket policy authorizes the S3 operation, while the key policy authorizes decryption of the object; both policies must explicitly allow the cross-account principal.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.