Allow only listing and reading with a single statement: Action = ["s3:*"], Resource = ["arn:aws:s3:::prod-reporting/incoming/*"].

This is overly broad because s3:* includes write and delete actions not required for reads. Least privilege requires restricting to s3:GetObject only. While the resource scope is close, wildcard actions expand permissions beyond the stated need.

Allow all S3 reads at the account level: Action = ["s3:GetObject"], Resource = ["arn:aws:s3:::*"].

Using arn:aws:s3:::* is not least privilege and allows access to every bucket in the account. Even though the action is GetObject, the scope is far wider than the required prefix. This would violate the stated requirement to restrict to s3://prod-reporting/incoming/.

Allow bucket listing with a condition that forces the prefix: Action = ["s3:ListBucket"], Resource = ["arn:aws:s3:::prod-reporting"], Condition = {"StringLike": {"s3:prefix": "incoming/*"}}.

This only affects ListBucket results, not object retrieval. GetObject calls require s3:GetObject permission on the specific object ARNs. Adding a condition to ListBucket does not resolve AccessDenied errors during GetObject for incoming objects.

What does this SAA-C03 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Allow reads with a prefix-scoped statement: Action = ["s3:GetObject"], Resource = ["arn:aws:s3:::prod-reporting/incoming/*"]. — S3 object reads require s3:GetObject permission on the object ARN(s) themselves, not just ListBucket on the bucket. The role’s existing ListBucket statement supports enumerating keys, but it does not authorize downloading objects. Option B grants s3:GetObject only for arn:aws:s3:::prod-reporting/incoming/*, matching the service’s requirement and minimizing blast radius. This is the most direct least-privilege fix for GetObject 403 errors. Why others are wrong: Option A is incorrect because s3:* grants unnecessary actions such as PutObject and DeleteObject, breaking least privilege. Option C is incorrect because arn:aws:s3:::* broadens access to every bucket in the account, not only prod-reporting/incoming/. Option D only refines ListBucket behavior; it still omits s3:GetObject, so GetObject requests will continue to fail with AccessDenied.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.