DVA-C02 Security Practice Question
A developer needs to grant temporary access to an Amazon S3 bucket for a user from a different AWS account. The developer wants to use the most secure method that does not require sharing long-term credentials. Which approach should the developer take?
⚠ Common exam trap
Candidates often confuse S3 bucket policies with cross-account access, thinking a bucket policy alone can grant temporary credentials, when in fact bucket policies only authorize access based on the requester's existing (long-term) credentials and do not issue temporary tokens.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use cross-account IAM roles with STS AssumeRole
Using cross-account IAM roles with AWS Security Token Service (STS) AssumeRole allows the external user to obtain temporary, limited-privilege credentials without sharing any long-term access keys. This approach follows the principle of least privilege and eliminates the risk of exposed static credentials, as the temporary credentials automatically expire after a configurable duration (default 1 hour, max 12 hours).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an IAM user in the developer's account and share the access keys
Why it's wrong here
Creating an IAM user in the developer's account and sharing its access keys grants persistent, long-term credentials. This approach is a significant security risk because if these keys are compromised, an attacker gains indefinite access to the S3 bucket and potentially other resources. It directly violates the principle of least privilege and does not provide temporary access, which is the core requirement of the question, making key rotation and management a manual burden.
- ✗
Use S3 bucket policy with a condition for the external account's IAM user
Why it's wrong here
While an S3 bucket policy can be configured to grant access to an external account's IAM user, this method still relies on the external user's own long-term credentials for authentication. The developer's account has no control over the lifecycle, rotation, or security posture of these external credentials. This approach does not provide temporary, time-limited access from the perspective of the resource owner and is less secure than using temporary session tokens.
- ✓
Use cross-account IAM roles with STS AssumeRole
Why this is correct
Using cross-account IAM roles with AWS Security Token Service (STS) AssumeRole is the most secure and recommended method for granting temporary access. The external user's identity assumes a pre-defined role in the developer's account, which then issues temporary, time-limited credentials (access key ID, secret access key, and session token). This approach eliminates the need to share long-term keys, provides fine-grained control over permissions, and automatically revokes access after the session duration expires.
- ✗
Use S3 access control lists (ACLs) with the external user's canonical user ID
Why it's wrong here
S3 Access Control Lists (ACLs) are a legacy permission mechanism that grants permissions to specific AWS accounts using their canonical user ID. This method is coarse-grained, less flexible than IAM policies, and does not support temporary credentials or session tokens. Relying on canonical user IDs for cross-account access is not recommended for modern security practices, as it provides persistent access and lacks the granular control and auditability offered by IAM roles and policies.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.