SAP-C02 Practice Question: Design Solutions for Organizational Complexity

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:root"
      },
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::central-logs-bucket/*",
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "true"
        }
      }
    }
  ]
}

A company has a central S3 bucket for logs (central-logs-bucket) in account 123456789012. The bucket policy is shown in the exhibit. A developer in account 111111111111 tries to access an object in the bucket using the AWS CLI without the --no-sign-request option. The request fails. What is the MOST likely cause?

⚠ Common exam trap

Many candidates confuse the `aws:SecureTransport` condition with request signing, or assume that a bucket policy that grants access to one account's root user automatically allows all IAM users in that account, when in fact it only allows the root user itself.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The bucket policy only grants access to the root user of account 123456789012, not to other accounts.

The bucket policy in the exhibit uses a Principal element of `"AWS": "arn:aws:iam::123456789012:root"`. This grants access only to the root user of account 123456789012, not to any IAM users or roles in that account, and certainly not to any principals in account 111111111111. When the developer from account 111111111111 attempts to access the object with a signed request (no --no-sign-request), the request is signed with credentials from that account, which are not listed in the Principal, so S3 denies the request.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The bucket policy denies access from all accounts except 123456789012.
Why it's wrong here
The policy only allows; there is no explicit deny.
✓
The bucket policy only grants access to the root user of account 123456789012, not to other accounts.
Why this is correct
The Principal is set to the root user of the bucket owner account.
✗
The request is not using HTTPS, so it is denied by the aws:SecureTransport condition.
Why it's wrong here
AWS CLI typically uses HTTPS.
✗
The request is not signed, so it is denied by the aws:SecureTransport condition.
Why it's wrong here
The --no-sign-request flag is not used; the request is signed.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SAP-C02 Practice Question: Design Solutions for Organizational Complexity

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question