DOP-C02 Security and Compliance Practice Question
An organization wants to grant cross-account access to an S3 bucket in Account A to a user in Account B. Which policy configuration is required?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A bucket policy in Account A and an IAM user policy in Account B
Cross-account access to an S3 bucket requires both a resource-based policy (bucket policy) on the bucket in Account A granting access to the user in Account B, and an identity-based policy (IAM user policy) in Account B allowing the user to access the bucket. Option A correctly includes both policies. Option B is incorrect because S3 bucket ACLs are legacy and not recommended for cross-account access. Option C is missing the bucket policy in Account A, so it is insufficient. Option D is missing the IAM user policy in Account B, so it is insufficient.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A bucket policy in Account A and an IAM user policy in Account B
Why this is correct
Combining a bucket policy in Account A that grants the IAM user ARN from Account B permissions on the target S3 bucket with an IAM user policy in Account B that approves the same actions is the standard method for cross-account S3 access. The bucket policy acts as the resource-based authorization, defining who can interact with the bucket and its objects; the IAM user policy acts as the identity-based authorization, allowing the user to invoke those S3 APIs. Without both explicit allows, the request is denied by AWS's default deny behavior.
- ✗
An S3 bucket ACL granting access to the user in Account B
Why it's wrong here
S3 bucket ACLs can only attach a canned grant or grant permissions to an entire AWS account via its canonical user ID, not to a distinct IAM user ARN in Account B; they do not support fine-grained, user-level cross-account authorization. Furthermore, S3 ACLs are a legacy access-control mechanism that has been deprecated for cross-account use cases, so relying on an ACL alone would not grant the specific IAM user access and is not a recommended or supported pattern for this scenario.
- ✗
An IAM user policy in Account B allowing access to the bucket
Why it's wrong here
The IAM user policy in Account B alone is insufficient because the S3 bucket is owned by Account A, and without a bucket policy in Account A that explicitly grants the cross-account principal access to the bucket, Account A's implicit deny blocks all requests from the IAM user. The IAM policy merely allows the user to request the operation, but the resource owner's permissions must also allow it; this is the missing resource-based authorization that makes the combination fail.
- ✗
A bucket policy in Account A granting access to the user in Account B
Why it's wrong here
A bucket policy in Account A that names the IAM user ARN in Account B as a principal creates a valid resource-based allowance, but the IAM user in Account B still lacks an identity-based permission that authorizes the S3 action in their own account. Because the user cannot perform a cross-account action without both the sender's permission (IAM policy) and the receiver's permission (bucket policy), the bucket policy by itself does not result in a successful operation—the missing IAM policy is the critical gap.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,013 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.