A backend service in AWS uses an IAM role to upload large files to an S3 bucket using multipart upload. The upload typically succeeds, but it intermittently fails during cleanup with this error: "AccessDenied: User is not authorized to perform: s3:AbortMultipartUpload" The role identity policy currently allows only: - s3:PutObject on arn:aws:s3:::my-bucket/uploads/* - s3:ListBucket on arn:aws:s3:::my-bucket with a prefix condition What is the best least-privilege change to fix the cleanup failure?

Add s3:AbortMultipartUpload for arn:aws:s3:::my-bucket/*.

This would fix the AccessDenied, but it is not least-privilege. The service only needs to abort uploads under the uploads/ prefix, so granting AbortMultipartUpload on the entire bucket broadens the scope unnecessarily.

Add s3:ListBucket for arn:aws:s3:::my-bucket/uploads/* so the service can find parts to abort.

The failure is explicitly for s3:AbortMultipartUpload. Listing parts is not what is being denied in the error message, and s3:ListBucket permissions generally do not grant the ability to abort multipart uploads.

Add kms:Decrypt permissions for the KMS key used to encrypt objects in the bucket.

kms:Decrypt is unrelated to aborting multipart upload sessions. The denied action is s3:AbortMultipartUpload, so adding KMS permissions would not address the missing S3 permission causing the cleanup failure.

What does this SAA-C03 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Add s3:AbortMultipartUpload for arn:aws:s3:::my-bucket/uploads/*. — The denied error names s3:AbortMultipartUpload. For multipart uploads, cleanup operations require permission to abort the multipart upload ID when a part upload fails or the client cancels. Therefore, the least-privilege fix is to add s3:AbortMultipartUpload scoped to only the object keys/prefix the service uses (arn:aws:s3:::my-bucket/uploads/*). Broadening ListBucket or adding unrelated KMS permissions will not resolve a missing AbortMultipartUpload permission. B grants a broader scope than necessary. C addresses a different class of action and does not match the denied API in the error message. D changes KMS permissions, but the denied API is S3 multipart abort/cleanup (s3:AbortMultipartUpload), not decryption.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.