DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  No additional steps are needed; the bucket policy alone is sufficient.

  Why it's wrong here

  For cross-account access to an S3 bucket, both the resource-based policy (the S3 bucket policy) and an identity-based policy (an IAM policy attached to the user or role in the requesting account) must explicitly grant the required permissions. A bucket policy grants permissions on the resource to a principal, but the principal itself must also be authorized by its own account's IAM system to perform the action. Therefore, relying solely on the bucket policy will result in an "Access Denied" error because the user in Account B lacks the necessary identity-based permissions.

• ✓

  The administrator of Account B must attach an IAM policy to the user that allows the required S3 actions.

  Why this is correct

  To successfully grant cross-account S3 access, the administrator of Account B must attach an IAM policy to the specific user or role that will be accessing the bucket. This identity-based policy explicitly authorizes the principal within Account B to perform the desired S3 actions, such as s3:PutObject, on the target bucket in Account A. This policy works in conjunction with the resource-based bucket policy in Account A, which grants permissions to Account B's principal, ensuring that both sides of the trust relationship are established for successful access.

• ✗

  Create a new IAM role in Account B and have the user assume the role.

  Why it's wrong here

  Using an IAM role is an alternative method, but the simplest is to attach a policy directly to the user. The question states the user needs to write objects, so a policy on the user works.

• ✗

  Enable S3 ACLs on the bucket and grant write access to the Account B user.

  Why it's wrong here

  ACLs are legacy and not recommended. Also, ACLs are for granting access to another AWS account explicitly, but the IAM user in that account still needs an IAM policy. The bucket policy approach is preferred.