DVA-C02 Troubleshooting and Optimization Practice Question
A developer is debugging an issue where an Amazon S3 bucket policy is not allowing cross-account access for a user from another AWS account. The bucket policy grants access to the other account's root user. The IAM user in the other account has an IAM policy that allows s3:GetObject on the bucket. When the user tries to download an object, they get an Access Denied error. What is the most likely cause?
⚠ Common exam trap
Many exam-takers assume a valid S3 bucket policy and IAM policy are sufficient, forgetting that KMS encryption adds an independent authorization layer that requires explicit kms:Decrypt permissions, which is a common oversight in cross-account S3 access scenarios.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The bucket is encrypted with SSE-KMS and the user does not have kms:Decrypt permission
The most likely cause is that the bucket is encrypted with SSE-KMS. When an S3 bucket uses AWS KMS customer master keys (CMKs) for server-side encryption, the bucket policy granting access to the root user of the other account is not sufficient. The IAM user in the other account must also have explicit kms:Decrypt permission on the KMS key, because S3 GetObject calls require decrypting the object before returning it. Without this KMS permission, the request fails with Access Denied even though the S3 bucket policy and IAM policy appear correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The bucket is encrypted with SSE-KMS and the user does not have kms:Decrypt permission
Why this is correct
When an S3 object is encrypted with Server-Side Encryption using AWS Key Management Service (SSE-KMS), the requesting principal requires two distinct permissions for GetObject operations. Beyond the s3:GetObject permission on the bucket, an explicit kms:Decrypt permission on the specific AWS KMS key used for encryption is mandatory. Without this crucial KMS permission, even a valid S3 bucket policy allowing s3:GetObject will result in an Access Denied error, as S3 cannot decrypt the object for the user.
- ✗
The bucket policy does not specify the user's ARN
Why it's wrong here
If a bucket policy grants access to an entire AWS account, typically by specifying the account's ARN as the Principal (e.g., arn:aws:iam::123456789012:root or arn:aws:iam::123456789012:*), then all IAM users and roles within that account are implicitly covered by the policy. In such a broad grant scenario, explicitly listing individual user ARNs within the bucket policy is not required. The policy's intent is to allow any principal in the specified account to perform the action, assuming their own IAM policy also permits it.
- ✗
The object's ACL is set to private
Why it's wrong here
AWS S3 permission evaluation follows a specific order, where a bucket policy's explicit Allow statement generally takes precedence over an object's Access Control List (ACL) for GetObject operations. If a bucket policy explicitly grants a principal permission to perform an action like s3:GetObject, that permission will override any restrictive settings on the object's individual ACL, such as being set to "private." Therefore, an object's private ACL would not prevent access if the bucket policy explicitly permits the action.
- ✗
The IAM policy does not include s3:ListBucket
Why it's wrong here
The s3:ListBucket permission is specifically designed and required for listing the contents of an S3 bucket, which includes enumerating all objects or prefixes within it. However, to retrieve a single, specific object from an S3 bucket, only the s3:GetObject permission is necessary. The ability to list the bucket's contents is entirely separate from the ability to download an individual object, meaning that missing s3:ListBucket would not cause an Access Denied error for a GetObject operation.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 724 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.