A company wants S3 access to be available only from private connectivity. They created an Interface VPC Endpoint for S3 (that provides private connectivity from their VPC to S3) and configured the application to use it from private subnets. The IAM role allows: - s3:GetObject on arn:aws:s3:::confidential-bucket/reports/* However, requests fail with AccessDenied. The S3 bucket policy includes an allow statement that permits GetObject only if: - aws:SourceVpce equals "vpce-0abc12345def6789" After redeploying the VPC endpoint, the application still uses the same IAM permissions but gets AccessDenied. What change is most likely to fix the issue?

Add internet egress via a NAT Gateway so the requests can reach S3 over the public endpoint.

This would violate the private-only requirement and would not satisfy the aws:SourceVpce condition in the bucket policy, because public routing does not present the same SourceVpce context to S3.

Remove the aws:SourceVpce condition from the bucket policy to ensure the IAM permissions are sufficient.

Removing SourceVpce would broaden access to requests originating outside the intended private connectivity path, including from the public internet, which defeats the stated security requirement.

Update the IAM role to add s3:PutObject permissions so the requests can be authorized.

The requests are failing for GetObject authorization (the action in the bucket policy condition). Adding PutObject permissions does not change the evaluation for s3:GetObject against the bucket policy.

What does this SAA-C03 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Update the bucket policy to allow the new VPC endpoint ID (the vpce-* value) created by the redeployment. — With bucket policies that include aws:SourceVpce conditions, S3 allows the request only when the request originates through the specified VPC endpoint ID. When the VPC endpoint is redeployed, the new endpoint instance typically gets a different vpce-* ID. The IAM role may still allow s3:GetObject, but the bucket policy condition becomes false, resulting in AccessDenied. Updating the bucket policy to reference the new VPC endpoint ID restores access while preserving private-only enforcement. B breaks the private-only design and still would not satisfy the SourceVpce condition. C removes the control used to enforce private connectivity. D changes an unrelated S3 action (PutObject) and does not address the bucket policy condition for GetObject.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.