Troubleshooting S3 Access Denied for PutObject with SSE-S3
Exhibit
Refer to the exhibit.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:PutObject"
],
"Resource": "arn:aws:s3:::my-data-lake/*",
"Condition": {
"StringEquals": {
"s3:x-amz-server-side-encryption": "AES256"
}
}
}
]
}A data engineer created an IAM policy to allow a Glue ETL job to read and write objects to an S3 bucket. The ETL job fails when writing data with the error 'Access Denied'. The job is configured to use SSE-S3 (AES256) encryption. What is the likely issue?
Quick Answer
This question is testing a subtlety in how S3 permissions are structured around ARNs: an IAM policy can grant an action on the object-level resource (the bucket/* ARN) while still missing the same action on the bucket-level resource (the bare bucket ARN), and certain write operations check both. Because the Glue ETL job is configured to use SSE-S3 encryption, the write request involves additional headers and bucket-level checks beyond a plain object write, and if the attached policy only lists the object ARN as a resource for s3:PutObject, those bucket-level checks fail even though the object-level grant looks correct on paper. The fix is to add the bucket ARN itself as a resource alongside the object ARN wildcard, since some operations genuinely need permission at both levels to succeed. This is a good reminder that Access Denied errors in S3 don't always mean a missing action verb in the policy, they can just as easily mean the right action is granted against the wrong resource scope. Whenever a scenario shows a policy that appears to allow the action in question, but a request still fails with Access Denied, look closely at whether the resource element of the policy covers every ARN level the operation actually touches, the bucket itself as well as the objects inside it, rather than assuming the action name alone is the problem.
⚠ Common exam trap
It's easy for candidates to assume `s3:PutObject` on the object ARN is sufficient for all write operations, overlooking that S3 requires the same permission on the bucket ARN for certain encryption-related or bucket-policy-evaluation scenarios.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The policy does not grant s3:PutObject on the bucket itself, which is needed for some write operations.
The error 'Access Denied' when writing to S3 with SSE-S3 encryption typically occurs because the IAM policy lacks the `s3:PutObject` permission on the bucket resource itself. While the policy may grant `s3:PutObject` on the object ARN (`arn:aws:s3:::bucket/*`), some S3 write operations—especially those involving encryption headers or bucket-level checks—also require the permission on the bucket ARN (`arn:aws:s3:::bucket`). Without this, the request is denied even if the object-level permission exists.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The policy grants s3:PutObject on all buckets, not just the specific one.
Why it's wrong here
The resource is specific to the bucket.
- ✗
The condition requires objects to be encrypted with SSE-KMS, but the job uses SSE-S3.
Why it's wrong here
The condition specifies AES256, which is SSE-S3.
- ✓
The policy does not grant s3:PutObject on the bucket itself, which is needed for some write operations.
Why this is correct
Bucket-level permissions may be required for certain write operations.
- ✗
The condition requires objects to use SSE-S3, but the job uses SSE-KMS.
Why it's wrong here
The job uses SSE-S3, not SSE-KMS.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This MLS-C01 question is part of Courseiva's 1,672-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on MLS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A data engineer is configuring an IAM policy to allow users to upload objects to an S3 bucket only if the objects are encrypted using SSE-S3. However, users are getting AccessDenied errors when uploading objects without specifying encryption. What is the most likely cause?
hard- A.The condition should check for aws:SourceIp instead of encryption
- ✓ B.The condition requires encryption to be specified, but the upload does not specify it
- C.The policy is attached to the wrong IAM user
- D.The bucket policy denies all PutObject without encryption
Why B: The policy allows PutObject only when encryption is AES256, but denies when no encryption is specified because the condition is not met. Option A is wrong because it's not a service control policy; Option C is wrong because the bucket policy is not shown; Option D is wrong because the condition checks for AES256, not KMS.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MLS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MLS-C01 exam.