Cross-Account S3 Access: Secure Configuration with Bucket and IAM Policies

• ✓ A.A bucket policy in Account A and an IAM user policy in Account B
• B.An S3 bucket ACL granting access to the user in Account B
• C.An IAM user policy in Account B allowing access to the bucket
• D.A bucket policy in Account A granting access to the user in Account B

Why A: Cross-account access to an S3 bucket requires both a resource-based policy (bucket policy) on the bucket in Account A granting access to the user in Account B, and an identity-based policy (IAM user policy) in Account B allowing the user to access the bucket. Option A correctly includes both policies. Option B is incorrect because S3 bucket ACLs are legacy and not recommended for cross-account access. Option C is missing the bucket policy in Account A, so it is insufficient. Option D is missing the IAM user policy in Account B, so it is insufficient.

• ✓ A.An S3 bucket policy in Account A and an IAM policy in Account B.
• B.An IAM role in Account A and an IAM policy in Account B.
• C.Only an IAM policy in Account B.
• D.Only an S3 bucket policy in Account A.

Why A: Option A is correct because cross-account access to an S3 bucket requires both a resource-based policy (the S3 bucket policy in Account A) that grants the necessary permissions to the principal from Account B, and an identity-based policy (an IAM policy in Account B) attached to the user that allows the S3 actions. The bucket policy explicitly authorizes the external user (by ARN), while the IAM policy ensures the user has the required permissions to initiate the request. Without both, the request will fail due to the lack of either resource-side authorization or identity-side authorization.

• A.Attach an IAM policy to the user in account 111111111111 allowing s3:GetObject.
• B.Set the bucket ACL to grant full control to account 222222222222.
• ✓ C.{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::222222222222:root"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::example-bucket/*"}]}
• D.{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::111111111111:root"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::example-bucket/*"}]}

Why C: Option C is correct because it uses a bucket policy to grant cross-account access to the S3 bucket. The policy specifies the destination account (222222222222) as the principal, allowing s3:GetObject on the bucket's objects. This is the standard AWS approach for cross-account S3 access, as bucket policies can grant permissions to principals in other AWS accounts.

• A.Bucket policy: { "Effect": "Allow", "Principal": "222222222222", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::example-bucket/*" } and IAM policy: same as A
• ✓ B.Bucket policy: { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::222222222222:root" }, "Action": "s3:GetObject", "Resource": "arn:aws:s3:::example-bucket/*" } and IAM policy: { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::example-bucket/*" }
• C.Only bucket policy as in A
• D.Only IAM policy as in A

Why B: Cross-account S3 access requires a bucket policy in the source account (111111111111) that grants permissions to the target account (222222222222) by specifying the principal as the target account's root ARN (arn:aws:iam::222222222222:root), and an IAM policy in the target account that allows the user to perform the action on the bucket. Option B correctly provides both: the bucket policy uses the correct principal ARN, and the IAM policy allows s3:GetObject on the bucket. Option A is incorrect because 'Principal': '222222222222' is invalid; it must be an ARN. Option C lacks the IAM policy, and option D lacks the bucket policy.