S3 Encryption IAM Policy for SageMaker Training
Exhibit
Refer to the exhibit.
```
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:PutObject"
],
"Resource": "arn:aws:s3:::my-bucket/*"
},
{
"Effect": "Deny",
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::my-bucket/*",
"Condition": {
"StringNotEquals": {
"s3:x-amz-server-side-encryption": "AES256"
}
}
}
]
}
```Refer to the exhibit. A SageMaker training job uses an IAM role with this policy. The training job writes output to s3://my-bucket/output/. Which statement about the policy is true?
Quick Answer
The correct answer is that the training job can write output objects only if server-side encryption with SSE-S3 is used. This is because the IAM policy for encrypted S3 training data includes a Deny statement on the s3:PutObject action with a condition requiring s3:x-amz-server-side-encryption to equal AES256, which is the encryption algorithm for SSE-S3. Any PutObject request that does not specify SSE-S3 encryption is explicitly blocked, while GetObject is allowed without any encryption requirement, making the Deny the decisive factor. On the AWS Certified Machine Learning Specialty MLS-C01 exam, this scenario tests your understanding of how IAM policy evaluation logic works—specifically that an explicit Deny overrides any Allow, and that conditional Deny statements are a common trap for candidates who overlook the condition. A useful memory tip is “Deny with a condition is still a Deny; if the condition isn’t met, the action is blocked.”
⚠ Common exam trap
The trap here is that candidates often overlook the Deny statement's condition and assume the Allow statement alone grants full PutObject access, or they misinterpret the Deny as blocking all PutObject requests, failing to see that it only blocks those without the required encryption header.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The training job can write output objects only if server-side encryption with SSE-S3 is used
The policy includes a Deny statement that explicitly denies PutObject requests unless the request includes the `x-amz-server-side-encryption` header set to `AES256`, which corresponds to SSE-S3. The Allow statement grants PutObject permission, but the Deny statement overrides it for any request that does not meet the encryption condition. Therefore, the training job can only write output objects if server-side encryption with SSE-S3 is used.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Allow statement allows all PutObject requests regardless of encryption
Why it's wrong here
Deny overrides Allow.
- ✓
The training job can write output objects only if server-side encryption with SSE-S3 is used
Why this is correct
Deny requires AES256 encryption.
- ✗
The Deny statement blocks all PutObject requests
Why it's wrong here
Only blocks if encryption is not AES256.
- ✗
The GetObject permission requires the object to be encrypted with SSE-S3
Why it's wrong here
No encryption condition on GetObject.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,672 original MLS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on MLS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A machine learning team is using SageMaker to train a model. They want to ensure that the training data is encrypted at rest in the S3 bucket and that the data is also encrypted during transit. Which configuration should they use?
medium- A.Use client-side encryption and transfer data via HTTP
- ✓ B.Use SSE-S3 encryption on the S3 bucket and enforce HTTPS
- C.Use SSE-KMS encryption on the S3 bucket and disable HTTP
- D.Use SSE-C encryption on the S3 bucket and HTTPS
- E.Use no encryption on S3 but use HTTPS
Why B: SSE-S3 provides server-side encryption at rest for objects in S3, and enforcing HTTPS ensures data is encrypted in transit using TLS. This combination meets the requirements for both encryption at rest and in transit without additional client-side complexity.
Variation 2. A machine learning team is using SageMaker to train a model. The training data is stored in an S3 bucket encrypted with AWS KMS. The training job fails with an 'AccessDenied' error. Which IAM permission is MOST likely missing from the SageMaker execution role?
medium- A.s3:GetObject
- B.s3:ListBucket
- ✓ C.kms:Decrypt
- D.kms:GenerateDataKey
Why C: The training data is stored in an S3 bucket encrypted with AWS KMS. When SageMaker reads the encrypted data, the execution role must have permission to decrypt the KMS key. Without `kms:Decrypt`, the role cannot access the encrypted objects, resulting in an 'AccessDenied' error even if S3 read permissions are present.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MLS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MLS-C01 exam.