SAP-C02 Practice Question: Design Solutions for Organizational Complexity

Exhibit

Refer to the exhibit.
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::111111111111:root"
      },
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::central-logging-bucket/AWSLogs/*",
      "Condition": {
        "StringEquals": {
          "s3:x-amz-acl": "bucket-owner-full-control"
        }
      }
    }
  ]
}

Refer to the exhibit. This bucket policy is applied to a central logging bucket in account 111111111111. Account 222222222222 wants to deliver CloudTrail logs to this bucket. However, log delivery fails. What is the MOST likely cause?

⚠ Common exam trap

Candidates often assume cross-account access requires the source account's root user as the principal, but AWS services like CloudTrail use service principals (e.g., `cloudtrail.amazonaws.com`) for cross-account log delivery, not IAM users or root accounts.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The principal should be the CloudTrail service principal, not the root account of 111111111111.

The bucket policy in the exhibit likely specifies the root user of account 111111111111 as the principal, but CloudTrail in account 222222222222 must be allowed to write logs. For cross-account CloudTrail log delivery, the principal must be the CloudTrail service principal (e.g., `cloudtrail.amazonaws.com`) rather than a specific AWS account root user, because CloudTrail assumes a service-linked role to deliver logs to the destination bucket. Without the correct service principal, the policy denies the write operation, causing log delivery to fail.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The resource ARN is incorrect.
Why it's wrong here
The ARN is correct for logs from any account.
✓
The principal should be the CloudTrail service principal, not the root account of 111111111111.
Why this is correct
CloudTrail uses a service principal to write logs across accounts.
✗
The bucket policy requires the x-amz-acl header, which CloudTrail does not set.
Why it's wrong here
CloudTrail does set bucket-owner-full-control.
✗
The bucket policy does not allow s3:PutObject for the account 222222222222.
Why it's wrong here
It allows the root account of 111111111111, not the delivering account.

Go deeper

SAP-C02 Practice Question: Design Solutions for Organizational Complexity

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question