Question 40 of 724
DVA-C02 Security Practice Question
A company wants to allow cross-account access to an S3 bucket in Account A from a role in Account B. The S3 bucket policy in Account A allows the role's ARN. However, access is denied. What is the most likely missing step?
⚠ Common exam trap
Candidates often assume a bucket policy alone is sufficient for cross-account access, overlooking the requirement for an IAM policy on the requesting role to explicitly allow the S3 actions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The role in Account B must have an IAM policy that allows the S3 actions.
Cross-account S3 access requires both a resource-based policy (the bucket policy in Account A) that grants access to the role ARN, and an identity-based policy (an IAM policy attached to the role in Account B) that explicitly allows the S3 actions. Without the IAM policy in Account B, the role lacks permission to perform the S3 operations, even though the bucket policy permits the access. This is a fundamental principle of AWS cross-account authorization: both the resource side and the principal side must grant the necessary permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add a bucket policy that denies access to all principals.
Why it's wrong here
Adding a bucket policy that explicitly denies access to all principals (e.g., `Principal: '*'`) would directly prevent any entity, including the desired cross-account role, from accessing the S3 bucket. This action directly contradicts the objective of *allowing* cross-account access, as explicit deny statements always take precedence over allow statements in IAM policy evaluation. Therefore, this configuration would block all access rather than enabling the specific cross-account permissions required.
- ✓
The role in Account B must have an IAM policy that allows the S3 actions.
Why this is correct
For successful cross-account access, both the resource-based policy (S3 bucket policy) and the identity-based policy (IAM policy attached to the role in Account B) must explicitly grant the necessary permissions. While the bucket policy grants the Account B role permission to *assume* access to the bucket, the role itself must possess an IAM policy allowing it to perform specific S3 actions like `s3:GetObject` or `s3:PutObject`. This dual authorization model ensures granular control and adherence to the principle of least privilege.
- ✗
Disable block public access settings on the bucket.
Why it's wrong here
Disabling S3 Block Public Access (BPA) settings is irrelevant for establishing secure cross-account access via an IAM role. BPA is specifically designed to prevent unintended *public* read or write access to S3 buckets, such as through misconfigured bucket policies or ACLs. Access granted to a specific IAM role in another AWS account is considered authenticated and authorized access, not public access, and therefore is not affected by BPA settings.
- ✗
Enable ACLs on the S3 bucket.
Why it's wrong here
Enabling Access Control Lists (ACLs) on the S3 bucket is a legacy method for managing permissions and is generally not the recommended approach for complex cross-account access scenarios. While ACLs can grant some permissions, S3 bucket policies offer far greater granularity and flexibility for defining permissions for specific IAM principals across accounts. Relying solely on ACLs for cross-account access is less manageable and less secure than using comprehensive bucket and IAM policies.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
4 more ways this is tested on DVA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A developer is configuring cross-account access for an S3 bucket. The source account (111111111111) wants to allow the target account (222222222222) to write objects to the bucket. The developer attaches the following bucket policy to the bucket in the source account: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::222222222222:root" }, "Action": "s3:PutObject", "Resource": "arn:aws:s3:::example-bucket/*" } ] } However, the write operation fails with AccessDenied. What is the most likely cause?
hard- ✓ A.The target account has not attached an IAM policy granting the user or role s3:PutObject
- B.The bucket has an S3 ACL that denies the target account
- C.The bucket policy does not allow s3:PutObject for the target account
- D.The bucket is encrypted with SSE-KMS and the target account lacks KMS permissions
Why A: Cross-account S3 access requires both a bucket policy that grants the target account principal (or a resource-based policy) AND an IAM policy in the target account that explicitly allows the user or role to perform the s3:PutObject action. Without the target account's IAM policy, the request is denied even if the bucket policy permits it, as the target account's principal lacks the necessary permissions to make the call.
Variation 2. A developer needs to grant an IAM user in Account A access to an S3 bucket in Account B. What is the correct combination of policies?
easy- A.An S3 bucket policy in Account B that allows the IAM user's ARN.
- ✓ B.An IAM policy in Account A allowing access to the S3 bucket, and a bucket policy in Account B allowing the IAM user.
- C.An IAM policy in Account A allowing access, and a bucket ACL in Account B granting access to the IAM user.
- D.Create an IAM role in Account B that the user can assume, and attach a bucket policy allowing the role.
Why B: Cross-account S3 access requires two policies: an IAM policy in the source account (Account A) granting the user permission to perform S3 actions on the bucket, and a bucket policy in the target account (Account B) that explicitly allows the IAM user's ARN. The bucket policy acts as a resource-based policy that delegates access to the external principal, while the IAM policy authorizes the user to make the request. Without both, the request will be denied by either the source account's implicit deny or the target account's default deny.
Variation 3. A developer needs to grant cross-account access to an Amazon S3 bucket. The developer's AWS account (Account A) owns the bucket, and a user in another account (Account B) needs to write objects to it. The developer has already added a bucket policy that grants the user in Account B permissions. What additional step is required?
easy- A.No additional steps are needed; the bucket policy alone is sufficient.
- ✓ B.The administrator of Account B must attach an IAM policy to the user that allows the required S3 actions.
- C.Create a new IAM role in Account B and have the user assume the role.
- D.Enable S3 ACLs on the bucket and grant write access to the Account B user.
Why B: Cross-account access to S3 requires both a resource-based policy (the bucket policy in Account A) and a user-based policy (an IAM identity-based policy in Account B). The bucket policy grants permissions to the Account B user, but that user cannot perform actions unless their own account explicitly allows those actions via an IAM policy. Without this, the request is denied by the user's own account's implicit deny, even if the bucket policy permits it.
Variation 4. A developer is configuring cross-account access to an S3 bucket. The bucket in Account A has a bucket policy granting access to an IAM role in Account B. The IAM role's trust policy allows the developer's IAM user in Account B to assume the role. When the developer tries to access the bucket from Account B using the assumed role, they receive an Access Denied error. Which additional step is required to resolve this?
hard- A.Add the developer's IAM user ARN to the bucket policy in Account A.
- B.Configure a VPC endpoint for S3 in Account A and attach it to the bucket policy.
- ✓ C.Ensure the bucket policy grants the necessary permissions to the IAM role ARN from Account B.
- D.Create an IAM user in Account A and grant it S3 access, then share the credentials with the developer.
Why C: Ensure the bucket policy grants the necessary permissions to the IAM role ARN from Account B. The developer is able to assume the IAM role in Account B, but the role itself does not have access to the S3 bucket because the bucket policy in Account A does not explicitly grant permissions to the role ARN. The bucket policy must include a statement allowing the role (e.g., arn:aws:iam::AccountB:role/RoleName) to perform the required actions on the bucket. Option A is incorrect because adding the developer's IAM user ARN to the bucket policy is unnecessary; the access is via the assumed role. Option B is incorrect because a VPC endpoint is not required for cross-account S3 access. Option D is incorrect because it bypasses the cross-account role setup and is less secure.
Last reviewed: Jun 24, 2026
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.