DVA-C02 Security Practice Question
A developer needs to grant an IAM user in Account A access to an S3 bucket in Account B. What is the correct combination of policies?
⚠ Common exam trap
Candidates often think a bucket policy alone is sufficient for cross-account access (Option A), forgetting that the IAM user's own account must also explicitly authorize the action through an IAM policy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An IAM policy in Account A allowing access to the S3 bucket, and a bucket policy in Account B allowing the IAM user.
Cross-account S3 access requires two policies: an IAM policy in the source account (Account A) granting the user permission to perform S3 actions on the bucket, and a bucket policy in the target account (Account B) that explicitly allows the IAM user's ARN. The bucket policy acts as a resource-based policy that delegates access to the external principal, while the IAM policy authorizes the user to make the request. Without both, the request will be denied by either the source account's implicit deny or the target account's default deny.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
An S3 bucket policy in Account B that allows the IAM user's ARN.
Why it's wrong here
An S3 bucket policy in Account B, while necessary for cross-account access, is insufficient on its own. The IAM user in Account A must also have an identity-based policy attached to them that explicitly grants permission to perform the desired S3 actions. Without this IAM policy, the user's request will be implicitly denied by their own account's permissions boundary before the bucket policy in Account B is even evaluated, preventing them from initiating the request.
- ✓
An IAM policy in Account A allowing access to the S3 bucket, and a bucket policy in Account B allowing the IAM user.
Why this is correct
This is the correct and most direct combination for granting cross-account S3 access to an IAM user. The IAM policy attached to the user in Account A provides the necessary identity-based permissions for the user to initiate S3 actions. Concurrently, the S3 bucket policy in Account B, a resource-based policy, explicitly grants permission to the specific IAM user's ARN from Account A, overriding the default deny for cross-account access. Both policies must grant permission for the request to be authorized successfully.
- ✗
An IAM policy in Account A allowing access, and a bucket ACL in Account B granting access to the IAM user.
Why it's wrong here
While an IAM policy in Account A is required, using a bucket ACL in Account B for cross-account IAM user access is an incorrect approach. S3 Access Control Lists (ACLs) are a legacy access control mechanism primarily designed for granting permissions to other AWS accounts or predefined groups, not directly to specific IAM users from external accounts. Bucket policies are the modern and recommended method for granular cross-account access control involving IAM principals, offering more flexibility and detailed control than ACLs.
- ✗
Create an IAM role in Account B that the user can assume, and attach a bucket policy allowing the role.
Why it's wrong here
Creating and assuming an IAM role in Account B is a valid and secure method for cross-account access, but it represents an indirect access mechanism rather than granting direct access to the IAM user. In this scenario, the user in Account A first assumes a role in Account B, temporarily adopting that role's permissions. The question implies a direct permission grant to the user's identity, making the two-step role assumption process a different approach, not the direct combination requested.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.