Question 1,027 of 724
How to Fix S3 SSE-KMS Access Denied in Cross-Account Scenarios
Users receive AccessDenied when downloading SSE-KMS encrypted S3 objects cross-account. Which two policies may need changes?
Quick Answer
The answer is that both the S3 bucket policy or IAM policy and the KMS key policy need changes to resolve the S3 SSE-KMS access denied cross-account error. This is because when an object is encrypted with SSE-KMS, the caller must have explicit s3:GetObject permission from the bucket policy or their IAM role, and the KMS key policy must grant kms:Decrypt to the caller’s AWS account or IAM role; without both, the decryption step fails silently with an AccessDenied even if S3 permissions appear correct. On the AWS Certified Developer Associate DVA-C02 exam, this scenario tests your understanding that SSE-KMS creates a two-layer permission model—S3 controls object access, while KMS controls key usage—and a common trap is forgetting that cross-account KMS key policies do not trust the caller’s account by default. Remember the memory tip: “S3 for the object, KMS for the key; both must say yes for the download to be free.”
⚠ Common exam trap
Watch out — candidates often assume only the S3 bucket policy needs updating, forgetting that SSE-KMS adds a second authorization layer via KMS key policies, which must explicitly allow the decrypt action for the cross-account caller.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
S3 bucket/object access policy or IAM policy
When accessing SSE-KMS encrypted S3 objects cross-account, the S3 bucket policy or the IAM policy must explicitly grant the s3:GetObject permission to the caller. Additionally, the KMS key policy must allow the kms:Decrypt action for the caller's AWS account or IAM role, because SSE-KMS uses a customer master key (CMK) to encrypt the object, and decryption requires KMS permissions. Without both policies, the request fails with AccessDenied even if the S3 permissions are correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
CloudFront cache policy
Why it's wrong here
This does not meet the stated requirement as directly as the correct option.
- ✓
S3 bucket/object access policy or IAM policy
Why this is correct
Correct for the stated requirement.
- ✓
KMS key policy allowing decrypt to the caller
Why this is correct
Correct for the stated requirement.
- ✗
Route 53 resolver rule policy
Why it's wrong here
This does not meet the stated requirement as directly as the correct option.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DVA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A developer receives an Access Denied error when trying to download an object from an S3 bucket. The developer's IAM policy is shown in the exhibit. The bucket policy also grants access. What is the MOST likely cause?
hard- A.The S3 bucket has block public access enabled.
- ✓ B.The S3 bucket uses SSE-KMS and the user lacks kms:Decrypt permission.
- C.The IAM policy does not allow s3:GetObject.
- D.The bucket policy denies access to the user.
Why B: If the bucket is encrypted with a KMS key, the user must also have kms:Decrypt permission. Option A is wrong because the policy explicitly allows s3:GetObject. Option C is wrong because the bucket policy also grants access, so it's not a bucket policy issue. Option D is wrong because public access is not required if IAM policies allow access.
Last reviewed: Jun 11, 2026
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.