MLS-C01 Exploratory Data Analysis Practice Question

Exhibit

Refer to the exhibit.

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::my-bucket",
                "arn:aws:s3:::my-bucket/*"
            ],
            "Condition": {
                "StringEquals": {
                    "s3:ExistingObjectTag/data-type": "training"
                }
            }
        }
    ]
}
```

A data scientist is trying to list objects in an S3 bucket named 'my-bucket' using the AWS CLI command: `aws s3 ls s3://my-bucket/`. The command fails with an access denied error. The IAM policy attached to the scientist's role is shown in the exhibit. What is the most likely cause of the failure?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The condition on the ListBucket action requires all objects to have the tag 'data-type'='training', which may not be satisfied.

The IAM policy includes the s3:ListBucket action with a condition that uses s3:ExistingObjectTag to require each object to have the tag 'data-type' set to 'training'. However, the ListBucket operation lists all objects in the bucket, and the condition is evaluated against each object. If any object in the bucket does not have this tag, the request fails with an access denied error. Option B is incorrect because the policy does include s3:ListBucket. Option C is incorrect because the bucket name 'my-bucket' is a valid resource identifier; the full ARN is not required. Option D is incorrect because the StringEquals operator is valid for this condition key; the issue is the condition's requirement, not the operator.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The condition on the ListBucket action requires all objects to have the tag 'data-type'='training', which may not be satisfied.
Why this is correct
The condition on ListBucket is problematic and may cause denial.
✗
The IAM policy does not include the s3:ListBucket action.
Why it's wrong here
The policy does include ListBucket.
✗
The policy does not grant access to the bucket because it uses 'my-bucket' instead of the full ARN.
Why it's wrong here
The ARN is correctly specified.
✗
The condition should use 'StringLike' instead of 'StringEquals'.
Why it's wrong here
StringEquals is correct for exact match.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

MLS-C01 Exploratory Data Analysis Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question