DVA-C02 Development with AWS Services Practice Question

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-bucket/*"
    },
    {
      "Effect": "Allow",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::my-bucket/*"
    }
  ]
}

The exhibit shows an IAM policy attached to a user. The user reports being unable to upload files to S3 bucket 'my-bucket'. What is the MOST likely cause?

⚠ Common exam trap

Many candidates assume an IAM allow is sufficient, forgetting that resource-based policies (like S3 bucket policies) can override with an explicit deny, making the user unable to upload despite having the correct IAM permissions.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The bucket policy denies the upload

The user has an IAM policy that grants s3:PutObject on 'my-bucket', but the bucket policy explicitly denies s3:PutObject for that user. Since an explicit deny in a resource-based policy overrides any allow in an identity-based policy, the upload fails. AWS IAM evaluates all policies, and a single explicit deny results in a final decision of deny.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The user needs s3:PutObjectAcl permission
Why it's wrong here
The `s3:PutObjectAcl` permission is specifically required only when an S3 upload operation explicitly attempts to set an Access Control List (ACL) on the new object, such as specifying a canned ACL like `bucket-owner-full-control`. For standard uploads where object ownership is enforced by the bucket policy or the object is owned by the uploading account, this permission is not necessary. Therefore, its absence does not inherently prevent a basic object upload.
✓
The bucket policy denies the upload
Why this is correct
An explicit `Deny` statement in an S3 bucket policy always takes precedence over any `Allow` statement in an attached IAM user policy, even if the IAM policy grants the necessary `s3:PutObject` permission. AWS's authorization logic dictates that if any policy in the evaluation path contains an explicit deny for a requested action, that action is forbidden, regardless of other allow statements. This ensures that bucket owners maintain ultimate control over their resources.
✗
The policy does not allow s3:ListBucket
Why it's wrong here
The `s3:ListBucket` permission is used for listing the contents of an S3 bucket, such as retrieving a list of objects or common prefixes. This permission is entirely distinct from the `s3:PutObject` action, which is required for uploading new objects into a bucket. Therefore, the absence or presence of `s3:ListBucket` has no direct bearing on a user's ability to successfully upload an object.
✗
The user does not have s3:GetObject permission
Why it's wrong here
The `s3:GetObject` permission grants the ability to retrieve or download an object from an S3 bucket. While it is a common S3 action, it is completely separate from the `s3:PutObject` permission, which is necessary for uploading an object. The question specifically concerns an upload operation, making the user's `s3:GetObject` permissions irrelevant to the success or failure of that particular action.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

DVA-C02 Development with AWS Services Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question