PAS-C01 Technology Practice Question

Exhibit

Refer to the exhibit.

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/CrossAccountRole"
      },
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::my-bucket/logs/*",
      "Condition": {
        "StringEquals": {
          "s3:x-amz-acl": "bucket-owner-full-control"
        }
      }
    }
  ]
}
```

A security engineer is troubleshooting an issue where a cross-account IAM role (arn:aws:iam::123456789012:role/CrossAccountRole) is unable to upload objects to an S3 bucket (my-bucket) owned by another account. The bucket policy is shown above. What is the MOST likely reason for the failure?

⚠ Common exam trap

Watch out — candidates often assume the bucket policy alone is sufficient for cross-account uploads, overlooking the requirement for the `bucket-owner-full-control` ACL header to transfer object ownership to the bucket owner.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The IAM role does not specify the x-amz-acl header with value bucket-owner-full-control in its PutObject request.

The bucket policy grants s3:PutObject to the IAM role, but when objects are uploaded cross-account, the object ACL defaults to the uploading account's full control. Without the `x-amz-acl: bucket-owner-full-control` header, the bucket owner (target account) does not own the object and may not be able to manage or delete it. The IAM role must explicitly set this header in the PutObject request to transfer object ownership to the bucket owner, otherwise the upload fails with an AccessDenied error.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The IAM role does not specify the x-amz-acl header with value bucket-owner-full-control in its PutObject request.
Why this is correct
The bucket policy condition requires this header; without it, the request is denied.
✗
The S3 bucket has versioning enabled, which requires additional permissions.
Why it's wrong here
Versioning does not affect the ability to upload objects; the condition is the issue.
✗
The resource ARN in the bucket policy is incorrect; it should be arn:aws:s3:::my-bucket/*.
Why it's wrong here
The resource ARN with logs/* is valid and restricts to the logs/ prefix.
✗
The bucket policy does not grant the s3:PutObject permission to the IAM role.
Why it's wrong here
The policy explicitly allows s3:PutObject for the specified role.

Visual reference

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

PAS-C01 Technology Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question