DOP-C02 Resilient Cloud Solutions Practice Question

Exhibit

Refer to the exhibit.

```
Resources:
  MyBucket:
    Type: AWS::S3::Bucket
    Properties:
      VersioningConfiguration:
        Status: Enabled
      BucketName: my-critical-bucket
  MyBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref MyBucket
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Deny
            Principal: '*'
            Action: 's3:*'
            Resource:
              - !Sub '${MyBucket.Arn}/*'
            Condition:
              Bool:
                'aws:SecureTransport': false
```

A DevOps team uses the above CloudFormation template to create an S3 bucket. What does the bucket policy accomplish?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

It denies all S3 operations on the bucket unless the request uses HTTPS.

The bucket policy uses a Deny effect with a condition that the request must use HTTPS (SecureTransport: false). This denies all S3 operations on the bucket unless the request is sent over HTTPS. Option B is incorrect because the policy does not target anonymous users specifically; it applies to all principals. Option C is incorrect because the policy denies all actions, not just delete. Option D is incorrect because it allows HTTP requests when the condition is not met, but the Deny overrides; the policy explicitly denies non-HTTPS requests.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
It denies all S3 operations on the bucket unless the request uses HTTPS.
Why this is correct
This statement uses an explicit Deny on all s3:* actions, conditioned on aws:SecureTransport being false. Any request made to the bucket over plain HTTP is therefore blocked regardless of the principal or whether an Allow policy exists; HTTPS requests are not affected by this Deny. The effect is to require TLS for every S3 API operation on the bucket.
✗
It denies all read access to the bucket for anonymous users.
Why it's wrong here
The policy's Deny is not limited to read operations like GetObject or ListBucket; it applies to every S3 action in the statement. It also does not target anonymous users specifically—Principal is set to '*' so authenticated IAM principals, roles, and account root users are equally denied, and only when the transport is HTTP. Anonymous access is instead governed by separate public-access block settings and bucket ACLs.
✗
It prevents anyone from deleting objects in the bucket.
Why it's wrong here
This Deny does not single out DeleteObject or DeleteBucket operations; it denies the full set of actions listed in the template, which covers writes, reads, and configuration changes. Moreover, the denial only triggers when SecureTransport is false, so a DeleteObject call sent over HTTPS would still be governed by whatever other Allow policies apply. Thus the policy neither prevents all deletions nor acts as a deletion firewall.
✗
It allows only HTTPS requests to the bucket and denies all HTTP requests.
Why it's wrong here
The template contains only a Deny effect with a SecureTransport condition—it does not include an Allow statement that explicitly grants HTTPS access. In authorization, an explicit Deny blocks HTTP requests, while HTTPS requests still require a separate Allow from the S3 bucket policy, IAM policy, or ACL; they are not 'allowed' by this policy. Saying it 'allows only HTTPS' misstates the default-deny nature of IAM, where absence of an Allow is not an implicit grant.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

DOP-C02 Resilient Cloud Solutions Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question