SAP-C02 Least-privilege permissions Practice Question
A company is deploying a new application on AWS and wants to implement a least-privilege IAM policy for an EC2 instance that needs to read from an S3 bucket (my-bucket) and write logs to CloudWatch Logs. Which TWO statements should be included in the IAM policy? (Choose two.)
⚠ Common exam trap
The trap is that candidates often include unnecessary permissions (like s3:PutObject) beyond what the stem explicitly requires, failing the least-privilege requirement. Always scope permissions to only the actions and resources stated.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
{"Effect": "Allow", "Action": ["s3:GetObject"], "Resource": "arn:aws:s3:::my-bucket/*"}
The correct answers are A and C. Option A grants s3:GetObject on the S3 bucket objects, allowing the EC2 instance to read data from the bucket. Option C grants the necessary permissions to create log streams and put log events to a specific CloudWatch Logs log group, enabling logging. These two statements adhere to least-privilege by scoping to the exact actions and resources needed. Option E (s3:PutObject) is not required because the stem only specifies reading from S3; including it would violate the least-privilege principle. Options B and D are incorrect because B uses a wildcard action (s3:*) and D uses a wildcard resource, both of which are too broad and not scoped.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
{"Effect": "Allow", "Action": ["s3:GetObject"], "Resource": "arn:aws:s3:::my-bucket/*"}
Why this is correct
Correct: Grants s3:GetObject on the bucket objects, allowing the EC2 instance to read data from S3 as required.
- ✗
{"Effect": "Allow", "Action": ["s3:*"], "Resource": "arn:aws:s3:::my-bucket/*"}
Why it's wrong here
Incorrect: s3:* includes all S3 actions, which is too broad and violates least-privilege.
- ✓
{"Effect": "Allow", "Action": ["logs:CreateLogStream", "logs:PutLogEvents"], "Resource": "arn:aws:logs:us-east-1:123456789012:log-group:my-log-group:*"}
Why this is correct
Correct: Grants logs:CreateLogStream and logs:PutLogEvents on the specific log group, allowing log writing as required.
- ✗
{"Effect": "Allow", "Action": ["logs:PutLogEvents"], "Resource": "*"}
Why it's wrong here
Incorrect: Uses a wildcard resource for logs, which is not scoped to the specific log group and violates least-privilege.
- ✗
{"Effect": "Allow", "Action": ["s3:PutObject"], "Resource": "arn:aws:s3:::my-bucket/*"}
Why it's wrong here
Incorrect: Grants s3:PutObject on the bucket, but the stem only requires reading from S3; this permission is unnecessary and violates least-privilege.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.