SCS-C02 Identity and Access Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  {"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::my-bucket/*"}

  Why it's wrong here

  This policy grants s3:GetObject on the object ARN, which permits downloading a single object's contents but does not authorize the s3:ListBucket action required to enumerate the bucket's keys. Listing is a bucket-level operation, so the Resource must be the bucket ARN (arn:aws:s3:::my-bucket), not the object wildcard. Without s3:ListBucket, any attempt to list objects, such as calling ListObjectsV2 or viewing the bucket in the Amazon S3 console, will fail with AccessDenied.

• ✓

  {"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::my-bucket"}

  Why this is correct

  This is the correct least-privilege policy because s3:ListBucket is the only permission needed to list the objects in a bucket, and it must be applied to the bucket ARN (arn:aws:s3:::my-bucket). Unlike object-level actions such as GetObject, ListBucket is evaluated against the bucket resource itself, so adding an object-path wildcard would make the ARN invalid. This statement grants exactly the ability to list keys and nothing else, such as reading or writing object contents.

• ✗

  {"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::my-bucket/*","Condition":{"StringEquals":{"s3:prefix":""}}}

  Why it's wrong here

  This policy incorrectly sets the Resource to the object ARN (my-bucket/*) instead of the bucket ARN, but s3:ListBucket is a bucket-level action that can only be authorized on the bucket itself. Using an object ARN makes the statement ineffective for listing, and the s3:prefix condition is not evaluated because the resource type already mismatches the action. Even if the condition were removed, the wrong resource prevents this statement from granting any actual permission.

• ✗

  {"Effect":"Allow","Action":"s3:*","Resource":"arn:aws:s3:::my-bucket/*"}

  Why it's wrong here

  This policy is far too permissive because s3:* allows every S3 action on all objects, exceeding the requirement to simply list. It also fails to work because s3:ListBucket, which is needed for listing, is a bucket-level action and requires the bucket ARN (arn:aws:s3:::my-bucket) as the Resource; the object ARN used here only covers object-level actions. A correct policy would scope down to a single ListBucket statement on the bucket, avoiding unintended access to object data.

Go deeper

Related to this question