DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "s3:*", "Resource": "arn:aws:s3:::my-app-data/*" } ] }

  Why it's wrong here

  This policy is overly permissive because the "Action": "s3:*" grants all possible S3 actions, including write operations like s3:PutObject and s3:DeleteObject, in addition to read actions. While the resource is correctly scoped to objects within 'my-app-data', allowing full control violates the principle of least privilege when only read-only access is required. This broad permission could lead to unintended data modification or deletion.

• ✗

  { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*" } ] }

  Why it's wrong here

  This policy is incorrect because the "Resource": "*" grants the s3:GetObject permission on all S3 buckets within the AWS account, not just the intended 'my-app-data' bucket. Although s3:GetObject is a specific read action, applying it to a wildcard resource allows an EC2 instance to retrieve objects from any bucket it might discover, posing a significant security risk by exposing data beyond the specified application's scope.

• ✗

  { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": "arn:aws:s3:::my-app-data/*" } ] }

  Why it's wrong here

  This policy is incorrect because it explicitly includes both "s3:GetObject" (read) and "s3:PutObject" (write) actions. While the resource "arn:aws:s3:::my-app-data/*" correctly scopes these permissions to objects within the specified bucket, the inclusion of s3:PutObject grants write capabilities. If the requirement is strictly read-only access, providing write access violates the principle of least privilege and introduces unnecessary security exposure.

• ✓

  { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::my-app-data/*" } ] }

  Why this is correct

  This policy correctly grants only the necessary read access to the specified S3 resources. The "Action": "s3:GetObject" precisely allows the retrieval of objects, which is a read-only operation. Furthermore, the "Resource": "arn:aws:s3:::my-app-data/*" correctly limits this permission to objects within the 'my-app-data' bucket, adhering to the principle of least privilege by preventing access to other buckets or broader S3 actions.

Go deeper

Related to this question