DVA-C02 Security Practice Question
A developer in Account A has an Amazon S3 bucket that contains sensitive data. The developer wants to grant an IAM user in Account B read-only access to objects in the bucket. The developer has added a bucket policy in Account A that grants s3:GetObject access to the IAM user's ARN. However, the IAM user in Account B still receives Access Denied errors. What additional configuration is required?
⚠ Common exam trap
Test-takers frequently assume a bucket policy alone is sufficient for cross-account access, overlooking the mandatory IAM policy in the target account that must explicitly allow the action.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add an IAM policy in Account B that allows the user to perform s3:GetObject on the bucket's ARN.
Cross-account access to S3 requires both a bucket policy in the source account (Account A) granting the necessary permissions to the target IAM user, and an IAM identity-based policy in the target account (Account B) that explicitly allows the same action (s3:GetObject) on the bucket's ARN. Without the IAM policy in Account B, the user lacks the authorization to initiate the request, even though the bucket policy permits it. This dual-permission model is a fundamental security requirement for cross-account S3 access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Add an IAM policy in Account B that allows the user to perform s3:GetObject on the bucket's ARN.
Why this is correct
The core principle for cross-account S3 access dictates that both the resource owner (Account A) and the identity owner (Account B) must explicitly grant permission. While the bucket policy in Account A grants permission *to* Account B, the IAM user in Account B still requires an identity-based policy attached to them that explicitly allows the `s3:GetObject` action on the specified bucket ARN. This two-policy evaluation ensures that both accounts agree on the access, making this the correct and necessary step.
- ✗
Create an S3 access point and grant the user access through it.
Why it's wrong here
S3 Access Points are a feature designed to simplify managing access to shared datasets, often used with VPCs or for large-scale data lakes. While they can be used for cross-account access, they do not eliminate the fundamental requirement for an IAM user to have an identity-based policy that grants them permission to use the Access Point and, by extension, access the underlying S3 bucket. Creating an Access Point without the necessary IAM policy would not resolve the access issue for the user.
- ✗
Change the bucket policy to grant access to the entire AWS account B instead of the specific user.
Why it's wrong here
Modifying the bucket policy to grant access to the entire AWS Account B, rather than a specific user, would satisfy the resource-based policy requirement from Account A's perspective. However, this approach violates the principle of least privilege by over-granting permissions to all principals in Account B. Crucially, it still does not provide the individual IAM user in Account B with the necessary identity-based policy to actually *perform* the `s3:GetObject` action, as the user still lacks explicit permission within their own account.
- ✗
Enable S3 object ownership and set the bucket ACL to grant read access to the user in Account B.
Why it's wrong here
S3 ACLs are legacy and not recommended. They also require the object owner to grant access, and the bucket policy is already in place. The missing piece is the IAM policy in the user's account.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 724 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.