DOP-C02 SDLC Automation Practice Question
Exhibit
Refer to the exhibit.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:PutObject"
],
"Resource": "arn:aws:s3:::my-bucket/*"
},
{
"Effect": "Allow",
"Action": [
"codedeploy:CreateDeployment",
"codedeploy:GetDeployment"
],
"Resource": "*"
}
]
}A DevOps engineer is creating a CodePipeline service role. The above IAM policy is attached to the role. The pipeline fails when trying to download artifacts from the S3 bucket. What is the issue?
⚠ Common exam trap
Test-takers frequently assume only s3:GetObject is needed for downloading artifacts, overlooking that CodePipeline's S3 action internally requires s3:ListBucket to resolve the object location before retrieval.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The policy is missing s3:ListBucket permission on the bucket.
The pipeline fails because the IAM policy grants s3:GetObject on the object ARN but lacks s3:ListBucket on the bucket ARN. CodePipeline's S3 artifact download action first calls ListBucket to verify the bucket exists and the object key is accessible before performing the GetObject call. Without s3:ListBucket, the initial validation fails, causing the pipeline to error out even though GetObject is allowed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Resource for S3 actions should be the bucket ARN, not the object ARN.
Why it's wrong here
The Resource for S3 actions should be the bucket ARN, not the object ARN. For object-level S3 operations such as s3:GetObject and s3:PutObject, the Resource must be the object ARN (e.g., arn:aws:s3:::bucket-name/* or a specific object key), not the bucket ARN. The bucket ARN (arn:aws:s3:::bucket-name) is only valid for bucket-level permissions like s3:ListBucket or s3:GetBucketLocation. Using the bucket ARN for GetObject would actually cause the policy to be invalid or too broad, so the original statement is incorrect.
- ✓
The policy is missing s3:ListBucket permission on the bucket.
Why this is correct
The policy is missing s3:ListBucket permission on the bucket. CodePipeline requires the ability to list the contents of the S3 artifact bucket in order to enumerate source objects, determine which artifacts are present, and trigger the pipeline correctly. s3:ListBucket is a bucket-level action, so its Resource must be the bucket ARN (arn:aws:s3:::bucket-name), not the object ARN. Without this permission, the pipeline will fail during the source stage with an access denied error, even though GetObject is present, because the service cannot discover which objects to fetch.
- ✗
The CodeDeploy actions require a specific resource ARN instead of '*'.
Why it's wrong here
The CodeDeploy actions require a specific resource ARN instead of '*'. This is incorrect because several CodeDeploy actions, such as codedeploy:CreateDeployment, codedeploy:GetDeployment, and codedeploy:RegisterApplicationRevision, do not support resource-level permissions and therefore must be scoped to '*' in IAM policies. Resource-level restrictions are only applicable to actions that support condition keys like codedeploy:applicationName, and even then, using '*' is acceptable for these actions unless you need fine-grained access control. Thus, the '*' is valid for the CodeDeploy actions in a CodePipeline service role.
- ✗
The Action list is missing s3:GetObjectVersion.
Why it's wrong here
The Action list is missing s3:GetObjectVersion. This is not a required permission because GetObjectVersion is only needed when the S3 source bucket has versioning enabled and CodePipeline is configured to retrieve a specific object version. For a standard S3 source where versioning is not enabled, the s3:GetObject permission is sufficient to download the current object. Adding GetObjectVersion to the policy would be harmless but unnecessary, so the statement that it is missing is incorrect.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 1,298 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.