Question 1,121 of 724
S3 ListObjects Access Denied: Add s3:GetObject Permission
A developer is debugging an issue where an IAM user cannot list objects in an S3 bucket. The user has the following IAM policy attached: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "s3:ListBucket", "Resource": "arn:aws:s3:::example-bucket" } ] }. What is missing?
Quick Answer
The answer is that the IAM policy is missing the s3:GetObject permission. While s3:ListBucket allows the user to see the names of objects in the bucket, the actual listing operation in the AWS console or SDK often implicitly requires s3:GetObject to retrieve object metadata such as size and last modified date; without it, the API call fails with an access denied error. On the AWS Certified Developer Associate DVA-C02 exam, this is a classic trap where candidates assume s3:ListBucket alone is sufficient for listing, but the exam tests that object-level read access is needed for the full list response. Remember that s3:ListBucket controls the bucket-level action of listing keys, while s3:GetObject controls reading the objects themselves—both are required for a complete list operation. Memory tip: "List the bucket, Get the objects" to recall that listing needs both permissions.
⚠ Common exam trap
A common mix-up: candidates assume s3:ListBucket alone is enough to list objects in the console or CLI, but they overlook that the console also needs s3:GetObject to display object metadata, leading them to incorrectly choose options like bucket policy or ACLs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The policy needs to also allow s3:GetObject on the objects.
The IAM policy only grants the s3:ListBucket permission, which allows listing the objects in the bucket but not reading their contents. To actually list objects, the s3:ListBucket action is sufficient; however, the question implies the user cannot list objects at all. The missing permission is s3:GetObject, which is required to retrieve object metadata and data when using certain S3 operations like GetObject or HeadObject. Without s3:GetObject, the user may fail to list objects if the bucket policy or ACLs require read access for the listing operation to succeed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Resource ARN is incorrect.
Why it's wrong here
The ARN is correct for the bucket.
- ✗
The bucket has a bucket policy that denies access.
Why it's wrong here
No mention of bucket policy denying access.
- ✗
The user needs to enable S3 ACLs.
Why it's wrong here
ACLs are not required for IAM policies.
- ✓
The policy needs to also allow s3:GetObject on the objects.
Why this is correct
ListBucket lists objects but doesn't allow reading them; GetObject is needed to view object details.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DVA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A developer is troubleshooting an issue where an IAM user cannot perform 's3:ListBucket' on a bucket. Which THREE factors could cause this denial?
medium- A.The bucket is in a different region than the user's default region.
- ✓ B.An explicit deny statement in the bucket policy.
- C.The bucket is encrypted with AWS KMS.
- ✓ D.The user has a permissions boundary that does not include s3:ListBucket.
- ✓ E.The user's IAM policy does not include s3:ListBucket.
Why B: Options B, D, and E can all cause denial of s3:ListBucket. Option B: an explicit deny in a bucket policy overrides any allows. Option D: a permissions boundary defines the maximum permissions for the user; if s3:ListBucket is not included, it is effectively denied even if the user's IAM policy allows it. Option E: if the user's IAM policy does not include s3:ListBucket, they lack the necessary permission.
Last reviewed: Jun 24, 2026
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.