SAA-C03 Design Secure Architectures Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Allow only listing and reading with a single statement: Action = ["s3:*"], Resource = ["arn:aws:s3:::prod-reporting/incoming/*"].

  Why it's wrong here

  This is overly broad because s3:* includes write and delete actions not required for reads. Least privilege requires restricting to s3:GetObject only. While the resource scope is close, wildcard actions expand permissions beyond the stated need.

  When this WOULD be correct

  This option would be correct in a scenario where the backend service needs full access (read, write, delete) to objects under s3://prod-reporting/incoming/ and the question explicitly allows granting all S3 actions under that prefix.

• ✓

  Allow reads with a prefix-scoped statement: Action = ["s3:GetObject"], Resource = ["arn:aws:s3:::prod-reporting/incoming/*"].

  Why this is correct

  This grants only the specific action s3:GetObject and scopes it to the exact prefix that the service needs. It aligns with least privilege by avoiding extra permissions like PutObject or DeleteObject. Since the service already has ListBucket, this completes the required read path for objects in incoming.

• ✗

  Allow all S3 reads at the account level: Action = ["s3:GetObject"], Resource = ["arn:aws:s3:::*"].

  Why it's wrong here

  Using arn:aws:s3:::* is not least privilege and allows access to every bucket in the account. Even though the action is GetObject, the scope is far wider than the required prefix. This would violate the stated requirement to restrict to s3://prod-reporting/incoming/.

  When this WOULD be correct

  This option would be correct in a scenario where the backend service needs to read objects from any S3 bucket in the account (e.g., a generic data processing service that handles multiple buckets), and the question does not restrict access to a specific bucket or prefix.

• ✗

  Allow bucket listing with a condition that forces the prefix: Action = ["s3:ListBucket"], Resource = ["arn:aws:s3:::prod-reporting"], Condition = {"StringLike": {"s3:prefix": "incoming/*"}}.

  Why it's wrong here

  ListBucket is a bucket-level permission that governs listing operations (e.g., ListObjectsV2), not object retrieval. Even with a prefix condition, it merely filters which keys appear in the listing; it does not authorize s3:GetObject on the underlying objects. To read an object, the IAM policy must grant s3:GetObject on the object ARN (e.g., arn:aws:s3:::prod-reporting/incoming/*). The s3:prefix condition is not evaluated for GetObject calls, so this statement leaves object reads completely unauthorized and AccessDenied persists.

  When this WOULD be correct

  If the question asked for a policy to restrict ListBucket to only list objects under a specific prefix (e.g., to limit what the backend can see), then adding a condition on s3:prefix would be correct.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SAA-C03 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official SAA-C03blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question