SCS-C02 Management and Security Governance Practice Question
A developer needs to grant an IAM user read-only access to an S3 bucket containing sensitive data. The bucket is encrypted with an AWS KMS customer managed key. Which set of permissions must be included in the IAM policy?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
s3:GetObject, kms:Decrypt
To read objects from an encrypted S3 bucket, the user needs both s3:GetObject to retrieve the object and kms:Decrypt to decrypt the object using the KMS key. Option A is wrong because it includes kms:Encrypt instead of kms:Decrypt; decryption is required, not encryption. Option C is wrong because it lacks s3:GetObject permission, which is necessary to retrieve the object. Option D is wrong because it includes s3:ListBucket, which is not required for reading a specific object, and it lacks s3:GetObject.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
s3:GetObject, kms:Encrypt
Why it's wrong here
Swapping kms:Decrypt for kms:Encrypt breaks the read path because the user would only be able to create new ciphertext, not decrypt the ciphertext returned by S3. During a GetObject call on an SSE-KMS object, S3 uses KMS to decrypt the data key, and without the s3:GetObject permission combined with kms:Decrypt that call fails. The kms:Encrypt permission is the wrong direction; read-only access requires decrypting existing ciphertext, not encrypting plaintext.
- ✓
s3:GetObject, kms:Decrypt
Why this is correct
This pair is correct because reading a KMS-encrypted S3 object is a two-step operation: S3 GetObject retrieves the ciphertext from the bucket, and KMS Decrypt decrypts the envelope-encrypted data key so the object's contents are revealed. The s3:GetObject permission allows the actual read of the object, while kms:Decrypt grants the ability to unwrap the key that protects that object. Together they provide exactly the read-only access required.
- ✗
kms:Decrypt
Why it's wrong here
Granting only kms:Decrypt is insufficient because the user never gets permission to call S3's GetObject API. For an SSE-KMS-encrypted object, the read path requires both an S3 data-plane action to fetch the object and a KMS action to unwrap the object's data key. Without s3:GetObject, the request is denied at the S3 layer before KMS is ever invoked.
- ✗
s3:ListBucket, kms:Decrypt
Why it's wrong here
This policy includes s3:ListBucket, which only authorizes listing bucket keys, not fetching the object itself, and it omits s3:GetObject entirely. Even if the user can see the object in a bucket listing, the actual GetObject call will be denied, and kms:Decrypt cannot compensate for that missing permission. Read-only access to a specific object requires GetObject, plus Decrypt for the KMS encryption.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,205 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.