A CI pipeline needs to upload build artifacts only to s3://ci-artifacts/uploads/*. You also want the pipeline to list only objects under uploads/ to verify that the upload succeeded. Which IAM policy approach is the best fit for least privilege?

Allow s3:PutObject on arn:aws:s3:::ci-artifacts/* and allow s3:ListBucket on arn:aws:s3:::ci-artifacts without any prefix condition.

This permits writes to any object path in the bucket and allows listing of all prefixes/keys because there is no condition restricting the ListBucket results to uploads/. That is broader than the uploads-only requirement.

Allow s3:GetObject on arn:aws:s3:::ci-artifacts/uploads/* so the pipeline can confirm artifacts exist.

s3:GetObject grants read access to objects; it does not grant permission to upload artifacts. The core requirement includes uploading to uploads/.

Allow s3:PutObject on arn:aws:s3:::ci-artifacts/uploads/* and also allow s3:DeleteObject on arn:aws:s3:::ci-artifacts/uploads/*.

DeleteObject is not required to verify an upload succeeded and increases blast radius by allowing the principal to remove uploaded artifacts. Least privilege favors granting only the minimum actions necessary (PutObject and scoped ListBucket).

What does this SAA-C03 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Allow s3:PutObject on arn:aws:s3:::ci-artifacts/uploads/* and allow s3:ListBucket on arn:aws:s3:::ci-artifacts with a condition that restricts s3:prefix to uploads/. — The pipeline needs two narrowly scoped capabilities: (1) upload to only the uploads/ prefix and (2) list only keys under that same prefix for verification. Option A enforces both controls by scoping s3:PutObject to arn:aws:s3:::ci-artifacts/uploads/* and scoping s3:ListBucket to arn:aws:s3:::ci-artifacts with a condition restricting s3:prefix to uploads/. This prevents the pipeline from writing to or listing unrelated locations, reducing risk if credentials are compromised. Why others are wrong: Option B is too permissive because it allows PutObject to any object path and allows ListBucket without restricting results to uploads/. Option C fails because GetObject does not provide upload capability. Option D grants an unnecessary destructive permission (DeleteObject), violating least privilege by increasing the range of actions the pipeline principal can perform.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.