How to Fix 'Access Denied' When Backing Up SAP HANA to Amazon S3
An SAP system administrator is troubleshooting a failed HANA database backup to Amazon S3. The backup job returns an error: 'Access Denied'. Which TWO actions should the administrator take to resolve the issue?
Quick Answer
An Access Denied error when writing a HANA backup to S3 means the request is being blocked somewhere in the permission chain, and troubleshooting it means checking both sides of that chain rather than assuming the problem is in only one place. The IAM role attached to the EC2 instance needs to explicitly grant the permissions required to write objects to the target S3 bucket; if that role is missing the right S3 actions or is scoped incorrectly, the backup job will be denied regardless of anything else being configured correctly. Separately, the S3 bucket policy itself needs to be checked for any explicit deny statements, since an explicit deny in a bucket policy can override an allow granted through IAM - so even a well-configured IAM role can still be blocked if the bucket policy itself is denying the request based on some condition. Because both an insufficiently permissive IAM role and an overly restrictive bucket policy produce the identical symptom of Access Denied, you need to check both rather than assuming one or the other is automatically the cause. This is different from other S3-adjacent settings that don't cause access errors on their own: S3 Transfer Acceleration is about upload speed, not access; whether a KMS key is enabled isn't the same issue as the IAM role lacking permission to use that key; and a VPC endpoint is only relevant if the network path requires it, not a factor when S3 is reachable over the public endpoint. When you see Access Denied writing to S3, check the IAM role's permissions and the bucket policy for explicit denies together.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Review the S3 bucket policy for any deny statements that may block the backup.
Options A and C are correct because reviewing the S3 bucket policy for deny statements that may block the backup is a direct step to resolve an 'Access Denied' error, and checking the IAM role attached to the EC2 instance for S3 permissions is also a primary cause of access issues. Option B is incorrect because S3 Transfer Acceleration improves speed, not access. Option D is incorrect because the KMS key being enabled is not a direct cause of access denied; rather, the IAM role must have permission to use the key. Option E is incorrect because a VPC endpoint is not required if using public S3.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Review the S3 bucket policy for any deny statements that may block the backup.
Why this is correct
Bucket policies can explicitly deny access to certain principals.
- ✗
Enable S3 Transfer Acceleration on the bucket.
Why it's wrong here
Transfer Acceleration does not affect access permissions.
- ✓
Check the IAM role attached to the EC2 instance for S3 permissions.
Why this is correct
The instance must have appropriate IAM permissions to write to S3.
- ✗
Verify that the S3 bucket's KMS key is enabled.
Why it's wrong here
KMS key permissions could be an issue, but not the most direct cause.
- ✗
Set up a VPC endpoint for S3.
Why it's wrong here
VPC endpoint is for private connectivity, not permission.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This PAS-C01 question is part of Courseiva's 1,616-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on PAS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An SAP administrator is troubleshooting a failed backup of SAP HANA to Amazon S3. The backup is initiated by an SAP HANA BACKUP command using the S3 backint agent. The error log shows 'HTTP 403 Forbidden' when the agent tries to upload to the S3 bucket. The bucket policy allows s3:PutObject from the VPC endpoint. What is the most likely cause?
hard- A.The S3 bucket does not exist.
- B.The S3 bucket is not in the same AWS Region as the EC2 instance.
- C.The S3 bucket uses server-side encryption with AWS KMS (SSE-KMS) and the IAM role lacks kms:GenerateDataKey.
- ✓ D.The VPC endpoint policy for S3 does not grant the required actions to the IAM role.
Why D: The HTTP 403 Forbidden error indicates that the request was received but denied. Since the bucket policy allows s3:PutObject from the VPC endpoint, the issue is likely that the VPC endpoint policy itself does not grant the required actions to the IAM role. VPC endpoint policies act as a separate layer that can override bucket policies. Option D is correct. Option A is wrong because the bucket exists. Option B is wrong because cross-region access would not cause a 403. Option C is wrong because SSE-KMS would cause a 400 error, not 403.
Variation 2. An SAP system administrator notices that nightly SAP HANA backups to Amazon S3 are failing intermittently with 'Access Denied' errors. The backups are initiated by an AWS Lambda function that uses an IAM role. The role has a policy that grants s3:PutObject on the backup bucket. Which additional IAM action is most likely required to resolve the issue?
hard- A.s3:ListBucket
- ✓ B.s3:PutObjectAcl
- C.s3:DeleteObject
- D.s3:GetObject
Why B: s3:PutObjectAcl is required when the bucket owner and the object uploader are different, or when the bucket policy requires the uploader to set ACLs to give the bucket owner full control. In this scenario, the Lambda function's IAM role likely needs this permission to successfully write objects to the S3 bucket, especially if the bucket is owned by a different AWS account or has a bucket policy that enforces specific ACLs. Without s3:PutObjectAcl, the upload may fail with 'Access Denied' when the bucket policy requires the uploader to grant the bucket owner full control. Option A (s3:ListBucket) is for listing objects, not uploading. Option C (s3:DeleteObject) is for deleting, not uploading. Option D (s3:GetObject) is for reading, not writing.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.