SCS-C02 Identity and Access Management Practice Question

A developer needs to grant an IAM user access to a specific S3 bucket only. Which IAM policy element should be used to restrict access to that bucket?

⚠ Common exam trap

SCS-C02 often tests the confusion between identity-based and resource-based policy elements, leading candidates to incorrectly choose Principal or Condition when asked how to restrict access to a specific resource in an identity-based policy.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Resource

The Resource element in an IAM policy specifies the AWS resource(s) to which the policy statement applies. For an S3 bucket, you use the bucket's ARN (e.g., arn:aws:s3:::bucket-name) or its objects (arn:aws:s3:::bucket-name/*) in the Resource field to restrict access to that specific bucket. This directly scopes the permissions to the intended bucket, ensuring the IAM user can only perform allowed actions on that resource.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Principal
Why it's wrong here
The Principal element specifies the identity that is granted or denied permissions, such as the IAM user, role, or federated user. In an identity-based policy attached to an IAM user, the principal is implicit and cannot be included; Principal is only valid in resource-based policies. Since the goal is to identify the specific resource to grant access to, Principal does not fulfill that requirement.
✗
Condition
Why it's wrong here
The Condition element defines the circumstances under which a policy takes effect, using keys like aws:SourceIp, aws:MultiFactorAuthPresent, or s3:prefix. While conditions can limit access based on context, they do not select which bucket or object is being accessed. Omitting Resource and including only a Condition would leave the policy without a target, making it invalid and unable to grant access to the specific resource.
✓
Resource
Why this is correct
The Resource element is the only policy element that specifies which service resources the action applies to, using Amazon Resource Names (ARNs). To grant an IAM user access to a specific S3 bucket, you must include that bucket's ARN in the Resource field, optionally with a wildcard for objects. Without the correct Resource entry, the policy cannot define the scope of access needed.
✗
Action
Why it's wrong here
The Action element lists the API operations the policy allows or denies, such as s3:ListBucket or s3:GetObject, and is required for the policy to be meaningful. It only describes what the user is allowed to do, not the destination resource. To target a specific bucket or object, you pair Action with the Resource element, so Action alone leaves the resource unspecified and the policy incomplete.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SCS-C02 Identity and Access Management Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question