Troubleshooting IAM aws:SourceIp Condition with EC2 and S3
Exhibit
Refer to the exhibit.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::example-bucket/*",
"Condition": {
"IpAddress": {
"aws:SourceIp": "10.0.0.0/24"
}
}
},
{
"Effect": "Allow",
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::example-bucket/uploads/*"
}
]
}An IAM policy is attached to an IAM user. The policy allows the `s3:PutObject` action on the resource `arn:aws:s3:::my-bucket/uploads/*` with a condition that the request must come from IP address `10.0.1.5`. The user is testing from an IP address `10.0.1.5`. What is the effect of the policy?
⚠ Common exam trap
The trap here is that candidates may misinterpret the IP condition as a Deny when it actually allows the action only if the condition is met, leading them to incorrectly select Option D.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Allow PutObject in uploads/ only
The attached IAM policy grants permission to perform PutObject on the 'uploads/' prefix, and the IP address condition matches the user's test IP (10.0.1.5). Therefore, the effect is to allow PutObject specifically on objects within the 'uploads/' folder.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Allow all actions on the bucket
Why it's wrong here
The policy grants only s3:PutObject on the uploads prefix, so it cannot authorise any other S3 action such as DeleteObject or GetObject. It is tempting because an Allow statement with a matching condition does take effect, but the scope of the action and resource ARN still constrains exactly what is permitted.
- ✓
Allow PutObject in uploads/ only
Why this is correct
The policy grants s3:PutObject on the uploads/* prefix, and the IP condition matches the tester's source address 10.0.1.5, so the request is allowed. Access remains scoped to that prefix only, not the whole bucket, because the resource ARN restricts it.
- ✗
Allow GetObject because the second statement overrides
Why it's wrong here
The policy contains a single statement permitting s3:PutObject, so no second statement exists to override anything, and GetObject is never granted. It is tempting because IAM evaluates all statements together, but with only one statement present there is nothing to conflict with or supersede the PutObject allowance.
- ✗
Deny all actions because of IP mismatch
Why it's wrong here
The source IP 10.0.1.5 matches the ip_address condition exactly, so the condition evaluates true and the Allow applies rather than a denial. It is tempting because a mismatched IP would indeed block the request, but here the condition is satisfied and no explicit Deny exists.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 984 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. A company has an IAM policy that allows s3:GetObject on all objects in 'my-bucket' but denies access to objects in the 'confidential' folder. A user tries to access 's3://my-bucket/confidential/report.pdf'. What will happen?
medium- ✓ A.Access is denied because the Deny statement explicitly matches the resource.
- B.Access is allowed because the Deny statement is not evaluated.
- C.Access is denied only if the user is not authorized by other policies.
- D.Access is allowed because the Allow statement is broader.
Why A: In AWS IAM, an explicit Deny always overrides any Allow. The policy denies access to objects in the 'confidential' folder, and the user's request matches that resource. Therefore, access is denied regardless of the Allow statement.
Variation 2. Refer to the exhibit. A company has an S3 bucket policy that allows GetObject access from two IP ranges (10.0.0.0/16 and 192.168.0.0/16). The policy also denies all S3 actions on the 'confidential/' prefix unless the request comes from the 10.0.0.0/16 range. Which of the following statements is true?
hard- A.Users from 192.168.0.0/16 can access objects in the confidential/ prefix.
- ✓ B.Users from 10.0.0.0/16 can access objects in the confidential/ prefix, but users from 192.168.0.0/16 cannot.
- C.Users from 10.0.0.0/16 cannot access objects in the confidential/ prefix.
- D.The policy has no effect because the Allow and Deny statements cancel each other.
Why B: The S3 bucket policy includes an explicit Deny statement that blocks all S3 actions on the 'confidential/' prefix unless the request originates from the 10.0.0.0/16 IP range. Since explicit Deny statements override any Allow statements in AWS IAM policy evaluation, users from 192.168.0.0/16 are denied access to the 'confidential/' prefix even though the GetObject Allow statement includes that range. Only users from 10.0.0.0/16 satisfy the condition in the Deny statement and can therefore access objects in the 'confidential/' prefix.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.