SAA-C03 Design Secure Architectures Practice Question

A partner company needs read-only access to reports in an S3 bucket for a B2B file exchange site. The partner has its own AWS account. What is the most secure scalable access pattern?

⚠ Common exam trap

Test-takers frequently choose Option B (sharing IAM user keys) because it seems simpler, but AWS recommends cross-account IAM roles for secure, temporary, and auditable access between accounts.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Create a bucket policy that grants the partner role least-privilege access to the required prefix

It uses a resource-based bucket policy that grants the partner's IAM role (from their own AWS account) least-privilege read-only access to a specific prefix. This avoids sharing long-term credentials, follows the principle of cross-account access using IAM roles and bucket policies, and is fully scalable without managing external users.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Make the objects public and rely on difficult-to-guess object names
Why it's wrong here
Making the objects public means granting the 'AllUsers' principal read access via an object ACL or bucket policy, so anyone with the object's URL can download it. A long random object name is not a security boundary; the URL can leak, be logged, or be guessed in a brute-force search, and AWS recommends S3 Block Public Access to prevent accidental exposure. This approach violates least privilege because it opens the objects to all internet users rather than only the partner.
✗
Create an IAM user in the company account and share the access keys
Why it's wrong here
Creating an IAM user in your account and sharing its access keys gives the partner long-term static credentials that retain permissions until actively revoked. Shared keys cannot be attributed to a specific individual in the partner organization, complicate rotation and auditing, and risk being embedded in client-side code or accidentally committed to source control. A cross-account IAM role with temporary STS credentials and an ExternalId is far more secure and auditable.
✓
Create a bucket policy that grants the partner role least-privilege access to the required prefix
Why this is correct
A bucket policy is a resource-based policy that can explicitly grant the partner's IAM role principal (e.g., 'arn:aws:iam::partner-account-id:role/PartnerReadOnlyRole') permission to call 's3:GetObject' on the 'reports/' prefix. By scoping the 'Resource' to 'arn:aws:s3:::your-bucket/reports/*' and optionally adding a condition such as 'aws:SourceArn' or 'ExternalId', you enforce least privilege without creating or distributing long-lived keys. This is the standard AWS pattern for granting cross-account read-only access to a limited S3 prefix.
✗
Copy the objects to a public website bucket
Why it's wrong here
Copying the objects to a bucket configured for public website hosting makes every object available over HTTP to any internet user, and static website endpoints do not enforce IAM authorization on their own. This design removes the ability to restrict the partner to a specific subset of reports or to revoke access quickly without deleting or re-architecting the bucket. It also risks unintended access by search engines and other clients, and it bypasses the principle of least privilege that S3 bucket policies are designed to enforce.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SAA-C03 Design Secure Architectures Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question