DVA-C02 Security Practice Question
A developer needs to grant an IAM role in the same AWS account read-only access to objects in a specific S3 bucket. The bucket is configured with a bucket policy that has an explicit Deny statement denying all principals except the root user. Which approach should the developer use to grant the required access?
⚠ Common exam trap
Test-takers frequently assume an IAM policy attached to the role is sufficient to override a bucket policy's explicit Deny, but they forget that explicit Deny always wins regardless of the source of the allow.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify the bucket policy to allow the IAM role explicitly, or remove the Deny statement
The bucket policy contains an explicit Deny that overrides any allow permissions, including those granted by an IAM policy attached to the role. To grant the IAM role read-only access, the developer must either remove the Deny statement or add an explicit Allow for the role in the bucket policy, because an explicit Deny in a resource-based policy cannot be overridden by an identity-based policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Modify the bucket policy to allow the IAM role explicitly, or remove the Deny statement
Why this is correct
To grant an IAM role read-only access when an explicit Deny exists in the bucket policy, the Deny statement must be modified or removed. AWS IAM policy evaluation logic dictates that an explicit Deny always takes precedence over any Allow statement, whether from an identity-based policy (on the role) or a resource-based policy (on the bucket). Adjusting the bucket policy to explicitly allow the specific IAM role for `s3:GetObject` actions, or ensuring the existing Deny no longer applies to that role, is the only way to permit access.
- ✗
Attach an IAM policy to the role that allows s3:GetObject on the bucket
Why it's wrong here
Attaching an IAM policy to the role that allows `s3:GetObject` will not override an explicit Deny statement present in the S3 bucket policy. AWS's policy evaluation logic is hierarchical, where an explicit Deny in any applicable policy (identity-based or resource-based) immediately denies access, regardless of any Allow statements. Therefore, even if the role's IAM policy grants permission, the bucket's explicit Deny will still prevent access.
- ✗
Use an S3 access point instead of the bucket directly
Why it's wrong here
Using an S3 Access Point instead of directly accessing the bucket does not bypass an explicit Deny statement in the underlying bucket policy. While Access Points can have their own policies, the effective permissions for any request are a combination of the Access Point policy, the requesting principal's IAM policies, and crucially, the underlying S3 bucket policy. An explicit Deny within the bucket policy will still take precedence and deny access, even if the request goes through an Access Point.
- ✗
Make the bucket public to allow all access
Why it's wrong here
Making the S3 bucket public to allow all access is a severe security misconfiguration and violates the principle of least privilege. This action typically involves removing all public access blocks and applying a bucket policy that grants `s3:GetObject` to the anonymous principal (`*`), exposing the data to the entire internet. This approach is inappropriate for granting controlled access to a specific IAM role within the same AWS account and introduces significant data exposure risks.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.