DVA-C02 Security Practice Question
A developer wants to grant a user in a different AWS account access to an S3 bucket. The developer has written a bucket policy that allows the user's IAM user ARN. However, the access is still denied. What is the most likely reason?
⚠ Common exam trap
Watch out — candidates often assume a bucket policy alone is sufficient for cross-account access, forgetting that the external user's IAM policy must also explicitly allow the action, as IAM denies all actions by default.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The user's IAM user policy does not explicitly allow the required S3 action
When granting cross-account access to an S3 bucket, both the bucket policy (resource-based policy) and the user's IAM policy (identity-based policy) must explicitly allow the action. The bucket policy alone is insufficient if the user's IAM policy does not include an explicit Allow for the S3 action, because IAM denies by default. Even though the bucket policy grants access, the user's own IAM policy must also permit the operation for the request to succeed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The user's IAM user policy does not explicitly allow the required S3 action
Why this is correct
For cross-account S3 access, both the resource-based bucket policy and the identity-based IAM user policy must explicitly grant the necessary permissions. If the user's IAM policy lacks an `Allow` statement for actions like `s3:GetObject` or `s3:PutObject`, even if the bucket policy permits the external account, the request will be denied. This dual authorization model ensures granular control from both the resource owner and the identity owner.
- ✗
The bucket policy does not have a principal of '*' to allow external accounts
Why it's wrong here
While a `Principal: '*'` in a bucket policy grants access to all AWS identities, it is not required for specific cross-account access. Instead, the bucket policy should specify the full ARN of the IAM user or role from the external account (e.g., `arn:aws:iam::ACCOUNT_ID:user/USERNAME`) as the `Principal`. This approach provides more secure and targeted access control than a broad wildcard, which is generally discouraged for specific cross-account scenarios.
- ✗
The bucket is in a different region than the user's account
Why it's wrong here
Amazon S3 buckets are global resources, meaning their names are unique across all AWS regions, and they can be accessed from any region. Accessing an S3 bucket from a different AWS region than where it resides does not inherently cause an access denied error. S3 handles cross-region data transfer and access seamlessly, provided the necessary IAM and bucket policies are in place to authorize the request.
- ✗
The user is using the wrong S3 endpoint (e.g., path-style vs virtual-hosted)
Why it's wrong here
S3 supports both virtual-hosted style (e.g., `bucket-name.s3.Region.amazonaws.com`) and path-style (e.g., `s3.Region.amazonaws.com/bucket-name`) endpoints. Using an incorrect endpoint style typically results in HTTP 301 (Moved Permanently) or 400 (Bad Request) errors, indicating a redirection or malformed request, rather than an explicit HTTP 403 (Access Denied) error. An access denied error specifically points to insufficient permissions, not an incorrect request format.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.