DVA-C02 Security Practice Question
A developer needs to grant cross-account access to an S3 bucket for an IAM user from another AWS account. The developer has added a bucket policy that allows the user's ARN. However, the user still cannot access the bucket. What additional step is required?
⚠ Common exam trap
Many candidates assume a bucket policy alone is sufficient for cross-account access, forgetting that the requesting account must also explicitly authorize the action via an IAM policy, which is a common oversight in AWS cross-account scenarios.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The user must have an IAM policy allowing the required S3 actions on that bucket
A is correct because cross-account access to an S3 bucket requires both a resource-based policy (the bucket policy) that grants access to the user's ARN and an identity-based policy (an IAM policy attached to the user) that explicitly allows the required S3 actions on that bucket. Without the IAM policy, the user's account denies the request by default, even if the bucket policy permits it. This is the principle of 'permission delegation' in AWS: the resource owner can grant access, but the user's own account must also authorize the action.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The user must have an IAM policy allowing the required S3 actions on that bucket
Why this is correct
For an IAM user in one AWS account to access an S3 bucket in another account, both the resource-based policy (bucket policy) and the identity-based policy (IAM user policy) must explicitly grant the necessary permissions. Even if the bucket policy permits the cross-account access, the IAM user's own policy must also authorize the specific S3 actions. This adherence to the principle of least privilege ensures that the user is explicitly allowed to perform the action from their identity's perspective.
- ✗
The bucket must be made public
Why it's wrong here
Making an S3 bucket public grants anonymous, unauthenticated access to its contents, which is a significant security vulnerability and violates the principle of least privilege. This approach bypasses the need for specific IAM policies but is not a secure or appropriate method for granting controlled cross-account access to a particular IAM user. Instead, granular IAM and bucket policies should be used to restrict access to authorized identities only.
- ✗
The user must use a different AWS CLI profile
Why it's wrong here
An AWS CLI profile primarily manages credentials, region, and output format for interacting with AWS services, but it does not define or alter the permissions associated with the underlying IAM identity. Changing profiles merely switches the set of credentials used for authentication, not the authorization policies attached to the IAM user or role. Therefore, using a different profile will not grant the necessary S3 permissions if the authenticated IAM identity lacks an appropriate identity-based policy.
- ✗
The resource-based policy must explicitly allow the user's ARN
Why it's wrong here
While a resource-based policy, specifically the S3 bucket policy, is absolutely essential for granting cross-account access by explicitly allowing the external IAM user's ARN, the question implies this step is already addressed. The 'missing piece' for cross-account access under the two-policy rule is often the identity-based policy on the requesting IAM user. Therefore, reiterating the need for the bucket policy is redundant if it's already in place, and it doesn't solve the user's missing permissions.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.