DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The bucket is encrypted with SSE-S3, which blocks cross-account access.

  Why it's wrong here

  SSE-S3 encryption manages the encryption and decryption of objects at rest using AWS-managed keys, but it does not inherently control access permissions. Access to S3 objects, regardless of SSE-S3 encryption status, is governed solely by the combination of IAM identity-based policies and S3 bucket policies. As long as the requesting principal has the necessary s3:GetObject or other relevant S3 permissions, S3 transparently handles decryption, making SSE-S3 irrelevant to cross-account access denial.

• ✗

  The bucket policy must use the user's ARN instead of the account ID.

  Why it's wrong here

  A bucket policy can effectively grant permissions to an entire external AWS account by specifying its account ID in the Principal element. This establishes the necessary trust relationship from the resource owner's side, allowing any principal within that external account to potentially access the bucket. However, for a specific IAM user or role within that trusted account to actually perform actions, they must also possess an explicit identity-based IAM policy that grants the corresponding S3 permissions. The account ID in the bucket policy is a valid and common method for cross-account access, not a blocker.

• ✗

  The bucket policy cannot grant access to users in another account.

  Why it's wrong here

  S3 bucket policies are a fundamental and widely used mechanism specifically designed to enable cross-account access to S3 resources. By explicitly listing the ARN of an external AWS account, an IAM user, or a role from another account in the Principal element of a bucket policy, the resource owner grants permission for those external principals to interact with the bucket. Stating that a bucket policy cannot grant cross-account access directly contradicts a core capability of S3's security model.

• ✓

  The IAM user in the other account does not have an IAM policy that allows the S3 action.

  Why this is correct

  For successful cross-account access to an S3 bucket, a 'two-way street' of permissions is required. While the S3 bucket policy must explicitly grant access to the external account or user, the IAM user in that external account must also possess an identity-based IAM policy that permits the specific S3 actions, such as s3:GetObject or s3:PutObject. If the user's IAM policy is missing or too restrictive, even with a permissive bucket policy, access will be denied, as both policies must allow the action.

Go deeper

Related to this question