SCS-C02 Identity and Access Management Practice Question
A company uses cross-account IAM roles to allow a third-party vendor to access resources in the company's AWS account. The security team wants to ensure that the vendor can only access the specific S3 bucket named 'vendor-bucket'. What should the security team do?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
In the trust policy of the role, specify the vendor's AWS account and attach a permissions policy that allows s3:* on 'vendor-bucket'. Also create a bucket policy that allows the role.
The correct approach is to create a cross-account IAM role for the vendor. In the role's trust policy, specify the vendor's AWS account as the trusted entity. Attach a permissions policy to the role that grants access only to the specific S3 bucket 'vendor-bucket' (e.g., s3:GetObject, s3:PutObject). Additionally, create a bucket policy on 'vendor-bucket' that allows the role to access the bucket. This ensures the vendor can only assume the role and access the designated bucket.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an IAM user for the vendor and attach a policy that allows access to 'vendor-bucket'.
Why it's wrong here
Creating an IAM user for the vendor distributes long-lived access keys or passwords that can be leaked and require manual rotation. Because the vendor's staff become an IAM principal inside your account, you lose visibility into which specific third-party action was performed, and you cannot use cross-account trust to restrict the source account. Roles using temporary credentials are the intended, more secure mechanism.
- ✓
In the trust policy of the role, specify the vendor's AWS account and attach a permissions policy that allows s3:* on 'vendor-bucket'. Also create a bucket policy that allows the role.
Why this is correct
The trust policy in the role should list the vendor's AWS account as a principal, allowing that account's users or roles to call sts:AssumeRole. The role's permissions policy then grants only s3:* on 'vendor-bucket' (e.g., arn:aws:s3:::vendor-bucket and arn:aws:s3:::vendor-bucket/*), adhering to least privilege. A bucket policy that explicitly allows the role can be added to make the resource-based authorization unambiguous and to satisfy any governance requirement that the bucket owner also approve access.
- ✗
Use an SCP to deny access to all S3 buckets except 'vendor-bucket'.
Why it's wrong here
A service control policy applies to every principal in the AWS account, including AWS services and your own employees, not just the vendor's assumed role. Denying all S3 buckets except 'vendor-bucket' would likely break other applications that need other buckets and could block S3 service-linked operations. SCPs are also organization-level guardrails that do not grant the vendor any ability to assume the role, so they cannot by themselves provide the required cross-account access.
- ✗
Create a new AWS account for the vendor and use VPC peering.
Why it's wrong here
Creating a separate AWS account for the vendor and peering VPCs adds network connectivity between VPCs, but VPC peering does not confer IAM permissions to call S3 APIs, and S3 is a global service that does not require network peering to access. This solution is unnecessarily complex, still requires you to create credentials for the vendor, and does not scope access to the specific 'vendor-bucket' object space. A cross-account IAM role directly addresses the access control requirement without new account infrastructure.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,205 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.