DVA-C02 Security Practice Question
A developer has an AWS Lambda function that needs to read objects from an S3 bucket in another account. The Lambda function's execution role includes an IAM policy that allows s3:GetObject on the bucket. The bucket owner has added a bucket policy that grants s3:GetObject to the Lambda execution role. However, the Lambda function receives Access Denied errors. The S3 bucket uses SSE-KMS for encryption. What is the most likely cause?
⚠ Common exam trap
The trap here is that candidates focus on the S3 bucket policy and IAM role for s3:GetObject, overlooking that SSE-KMS introduces a separate KMS authorization layer that must be explicitly configured.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Lambda function does not have kms:Decrypt permission on the KMS key used by the bucket.
When an S3 bucket uses SSE-KMS, the Lambda function must have explicit kms:Decrypt permission on the KMS key to decrypt the object after s3:GetObject retrieves the encrypted data. Even though the bucket policy and execution role allow s3:GetObject, the missing KMS permission causes an Access Denied error because S3 returns the encrypted object and the Lambda runtime cannot decrypt it without the key.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The S3 bucket does not have versioning enabled.
Why it's wrong here
S3 object versioning is a feature designed to maintain multiple versions of an object, protecting against accidental deletions or overwrites and enabling recovery of previous states. However, versioning is not a prerequisite for simply reading the current version of an object from an S3 bucket. A Lambda function can successfully retrieve an object regardless of whether versioning is enabled or disabled, provided all other necessary access permissions are correctly configured.
- ✗
The Lambda function's execution role does not have an explicit allow for s3:GetObject.
Why it's wrong here
The question explicitly states that the Lambda function's execution role *does* include an IAM policy that allows the `s3:GetObject` action. This permission is fundamental and absolutely required for any principal to retrieve objects from an S3 bucket. Since this critical permission is confirmed to be present on the Lambda's execution role, the inability to read objects must stem from a different access control or configuration issue, not a missing `s3:GetObject` permission.
- ✗
The Lambda function is not in the same AWS region as the S3 bucket.
Why it's wrong here
AWS S3 buckets are regional resources, and Lambda functions are also deployed within specific AWS regions. While it is often recommended for performance and cost efficiency to co-locate resources, S3 inherently supports cross-region access. A Lambda function deployed in one AWS region can successfully read objects from an S3 bucket located in a different region, provided the Lambda's execution role has the necessary `s3:GetObject` permissions and any other required access, such as KMS decrypt permissions, are properly configured.
- ✓
The Lambda function does not have kms:Decrypt permission on the KMS key used by the bucket.
Why this is correct
When an S3 bucket utilizes Server-Side Encryption with AWS KMS (SSE-KMS) for object encryption, any entity attempting to read those encrypted objects requires two distinct sets of permissions. First, it needs `s3:GetObject` permission on the S3 bucket and object. Second, and critically, the Lambda function's execution role must also have `kms:Decrypt` permission on the specific AWS KMS key used to encrypt the objects. This `kms:Decrypt` permission is granted via the KMS key policy, not the S3 bucket policy, and without it, the Lambda cannot decrypt the object data even if it successfully retrieves the encrypted bytes from S3.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.