A reporting application in Account B must read files from an S3 bucket in Account A. The bucket contains objects encrypted with a customer managed KMS key in Account A. The application role in Account B already has an identity policy allowing s3:GetObject on the bucket prefix, but requests still fail with AccessDenied. Which two changes are required for the application to read the objects? Select two.

Attach an IAM policy in Account B that grants s3:* on the bucket and its objects.

An identity policy in Account B alone cannot authorize access to a bucket in another account. S3 also requires a matching resource policy or equivalent cross-account trust, and broad s3:* is unnecessary for least privilege.

Create an S3 gateway endpoint in Account B so the application can reach the bucket privately.

A gateway endpoint can improve private connectivity, but it does not solve missing authorization. The AccessDenied error here is caused by cross-account permission and KMS policy gaps, not by the network path.

Add an SCP in Account A that allows the Account B role to bypass KMS encryption checks.

Service control policies do not grant access to a specific external role and cannot bypass KMS authorization. SCPs only set guardrails for accounts and OUs; they do not replace bucket or key policies.

What does this SAA-C03 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Add a bucket policy in Account A that allows the Account B role to perform s3:GetObject on the required prefix. — For an external role to read SSE-KMS encrypted objects, two separate permission layers must succeed. First, the S3 bucket policy in the owning account must allow the role to perform the object read. Second, the KMS key policy must allow that same role to use kms:Decrypt so S3 can unwrap the object data key. Either permission missing causes AccessDenied, even when the role has an identity policy in its own account. Why others are wrong: An identity policy in the caller account does not authorize cross-account access by itself, so broader s3:* still fails. A gateway endpoint only changes network routing and is unrelated to authorization. An SCP cannot be used to grant a foreign role access or override KMS controls, so it is not a fix for this failure.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.