A CI pipeline in account A uploads build artifacts to an S3 bucket (arn:aws:s3:::build-artifacts-prod) under the prefix teamA/. The pipeline must not be able to list other prefixes, and it must only upload objects under teamA/. Which IAM policy design best enforces least privilege for this requirement?

Allow s3:PutObject on arn:aws:s3:::build-artifacts-prod/* and allow s3:ListBucket on arn:aws:s3:::build-artifacts-prod with no condition.

This is too permissive because PutObject is scoped to the entire bucket (arn:aws:s3:::build-artifacts-prod/*), allowing uploads outside teamA/. It also allows ListBucket for the full bucket without any s3:prefix condition, so the pipeline could list other prefixes.

Allow s3:PutObject on arn:aws:s3:::build-artifacts-prod/teamA/* and allow s3:GetBucketLocation on arn:aws:s3:::build-artifacts-prod/teamA/.

GetBucketLocation is not required to satisfy the listed controls (upload only to teamA/ and list only within teamA/). Additionally, scoping GetBucketLocation to a prefix is not the right control for restricting ListBucket results; the missing piece is the constrained s3:ListBucket permission with an s3:prefix condition.

Allow s3:* on arn:aws:s3:::build-artifacts-prod/teamA/* and allow s3:ListAllMyBuckets for easier auditing.

s3:* is broader than needed and can grant permissions such as DeleteObject or other read/write capabilities beyond what is required. ListAllMyBuckets is unrelated to preventing access to other prefixes within the target bucket and expands exposure outside the intended control boundary.

What does this SAA-C03 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Allow s3:PutObject on arn:aws:s3:::build-artifacts-prod/teamA/* and allow s3:ListBucket on arn:aws:s3:::build-artifacts-prod with a condition that requires s3:prefix equals 'teamA/'. — Least privilege here requires two separate controls: (1) limit object writes to only teamA/ by granting s3:PutObject on the object ARN arn:aws:s3:::build-artifacts-prod/teamA/*, and (2) limit what the pipeline can discover via listing by granting s3:ListBucket on the bucket ARN arn:aws:s3:::build-artifacts-prod while adding a condition such as s3:prefix = 'teamA/'. This combination prevents uploads outside teamA/ and restricts list visibility to only the intended prefix. Option A allows uploads to any prefix (PutObject uses /*) and permits bucket listing without restricting s3:prefix, so the pipeline can enumerate other teams’ objects/prefixes. Option C does not implement the required listing restriction; it adds an unrelated permission rather than controlling s3:ListBucket results with s3:prefix. Option D grants s3:* which increases the blast radius beyond the minimum required actions and adds an unrelated account-wide listing permission (ListAllMyBuckets).

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.