DVA-C02 Security Practice Question
A developer needs to grant cross-account access to an S3 bucket owned by Account A to a user in Account B. Which approach is the most secure?
⚠ Common exam trap
It's easy for candidates to assume an IAM policy in the target account alone is sufficient for cross-account S3 access, forgetting that the owning account must explicitly allow the access via a resource-based policy like a bucket policy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a bucket policy in Account A that grants access to the user in Account B, and attach an IAM policy to the user in Account B allowing the S3 actions.
The most secure because it combines a resource-based bucket policy in Account A that explicitly grants access to the user in Account B with an identity-based IAM policy attached to that user in Account B. This dual-policy approach ensures that the user can only access the bucket when both policies allow the action, following the principle of least privilege and avoiding the need to share long-term credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an IAM role in Account A with a trust policy allowing the user from Account B to assume it.
Why it's wrong here
This option describes a valid mechanism for cross-account access, but it is not the most secure for an S3 bucket. While an IAM role in Account A can be assumed by a user in Account B, this approach relies on an identity-based policy attached to the role to grant S3 permissions. The most secure method for cross-account S3 access involves a resource-based bucket policy directly on the S3 bucket, explicitly defining external principals and their permissions. This role-based approach is suitable for granting broad cross-account access to services beyond S3, or when the external account needs to perform actions on multiple resources within Account A.
- ✗
Share the access keys of an IAM user in Account A with the user in Account B.
Why it's wrong here
Sharing the access keys of an IAM user in Account A with a user in Account B is a highly insecure practice that violates AWS security best practices. Access keys provide programmatic access equivalent to the IAM user's permissions, making them a critical credential. If compromised, these keys could grant unauthorized access to all resources the IAM user can access, leading to data breaches or unauthorized resource manipulation. This method bypasses the granular control and auditing capabilities of IAM policies and roles, making it impossible to revoke access specifically for the user in Account B without impacting all other legitimate uses of those keys.
- ✓
Add a bucket policy in Account A that grants access to the user in Account B, and attach an IAM policy to the user in Account B allowing the S3 actions.
Why this is correct
This is the most secure and recommended method for granting cross-account S3 access, adhering to the principle of least privilege. The bucket policy in Account A, a resource-based policy, explicitly grants permission to the specific IAM user (or role) in Account B to perform defined S3 actions on the bucket. Concurrently, an identity-based IAM policy attached to the user in Account B explicitly allows that user to perform those same S3 actions. Both policies must grant the necessary permissions for access to be successful, creating a robust and auditable access control mechanism.
- ✗
Attach an IAM policy to the user in Account B that grants access to the S3 bucket.
Why it's wrong here
Attaching an IAM policy to a user in Account B that attempts to grant access to an S3 bucket in Account A is insufficient on its own. An identity-based IAM policy defines what actions a principal *can perform* within its own account or on resources that explicitly grant it permission. However, it cannot unilaterally grant access to a resource owned by a different AWS account. For cross-account access, the resource owner (Account A) must explicitly permit the external principal (user in Account B) via a resource-based policy, such as a bucket policy, for the access request to be evaluated and potentially granted.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 724 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on DVA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A developer needs to grant cross-account access to an S3 bucket for an IAM user from another AWS account. The developer has added a bucket policy that allows the user's ARN. However, the user still cannot access the bucket. What additional step is required?
easy- ✓ A.The user must have an IAM policy allowing the required S3 actions on that bucket
- B.The bucket must be made public
- C.The user must use a different AWS CLI profile
- D.The resource-based policy must explicitly allow the user's ARN
Why A: A is correct because cross-account access to an S3 bucket requires both a resource-based policy (the bucket policy) that grants access to the user's ARN and an identity-based policy (an IAM policy attached to the user) that explicitly allows the required S3 actions on that bucket. Without the IAM policy, the user's account denies the request by default, even if the bucket policy permits it. This is the principle of 'permission delegation' in AWS: the resource owner can grant access, but the user's own account must also authorize the action.
Variation 2. A developer wants to grant a user in a different AWS account access to an S3 bucket. The developer has written a bucket policy that allows the user's IAM user ARN. However, the access is still denied. What is the most likely reason?
easy- ✓ A.The user's IAM user policy does not explicitly allow the required S3 action
- B.The bucket policy does not have a principal of '*' to allow external accounts
- C.The bucket is in a different region than the user's account
- D.The user is using the wrong S3 endpoint (e.g., path-style vs virtual-hosted)
Why A: When granting cross-account access to an S3 bucket, both the bucket policy (resource-based policy) and the user's IAM policy (identity-based policy) must explicitly allow the action. The bucket policy alone is insufficient if the user's IAM policy does not include an explicit Allow for the S3 action, because IAM denies by default. Even though the bucket policy grants access, the user's own IAM policy must also permit the operation for the request to succeed.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.