DVA-C02 Security Practice Question
A company has an Amazon S3 bucket (Bucket-A) in Account A that contains sensitive data. A developer in Account B needs read-only access to objects in Bucket-A. The developer in Account A added a bucket policy granting s3:GetObject to the IAM user in Account B. However, the IAM user in Account B still receives Access Denied errors. What additional step is required?
⚠ Common exam trap
Watch out — candidates often assume a bucket policy alone is sufficient for cross-account access, forgetting that the IAM user in the target account must also have an explicit allow policy for the action.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an IAM policy in Account B that allows s3:GetObject for the specific bucket and attach it to the user
The bucket policy in Account A grants access to the IAM user in Account B, but the user's identity in Account B must also have an explicit IAM policy that allows the s3:GetObject action. Without this, the user in Account B lacks the necessary permissions to access the bucket, even though the bucket policy permits it. This is because cross-account access requires both a resource-based policy (bucket policy) in the source account and an identity-based policy (IAM policy) in the target account to authorize the request.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add an S3 bucket ACL granting the user in Account B Read access
Why it's wrong here
S3 Access Control Lists (ACLs) are a legacy access control mechanism that primarily grant permissions to AWS accounts or predefined groups, not specific IAM users in another account. While an ACL could grant READ access to Account B as a whole, the individual IAM user within Account B would still lack the necessary explicit s3:GetObject permission from their own account's IAM policy. Therefore, ACLs alone do not resolve the missing IAM permission for the specific user and are generally less granular than bucket policies for cross-account access.
- ✓
Create an IAM policy in Account B that allows s3:GetObject for the specific bucket and attach it to the user
Why this is correct
For cross-account access to an S3 bucket, the "two-account" principle dictates that both the resource owner (Account A) and the principal's account (Account B) must explicitly grant permission. The bucket policy in Account A would permit s3:GetObject for the principal in Account B, and this IAM policy in Account B would then authorize the specific user to perform s3:GetObject on the designated bucket. This combined approach ensures the user has the necessary permissions from both sides of the trust relationship.
- ✗
Generate a pre-signed URL for each object and share it with the user
Why it's wrong here
Pre-signed URLs provide temporary, time-limited access to *specific* S3 objects, generated by an AWS credential with permissions to that object. While they grant access, they are not a scalable or permanent solution for a user needing general s3:GetObject permissions across an entire bucket or for programmatic access. Managing and distributing individual pre-signed URLs for numerous objects, especially when they expire, introduces significant operational overhead and is not an effective access management strategy.
- ✗
Add a condition in the bucket policy to allow requests only from the user's IP address
Why it's wrong here
A condition in an S3 bucket policy, such as aws:SourceIp, acts as an additional constraint or filter on permissions that have *already been granted*. It does not, by itself, grant any permissions. If the user in Account B does not possess the fundamental s3:GetObject permission through their own IAM policy, adding an IP condition to the bucket policy will not enable access; it would merely restrict access further *if* the necessary permissions were otherwise in place. This option misinterprets the role of policy conditions.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.