SCS-C02 Identity and Access Management Practice Question

A security engineer is reviewing an IAM policy that grants permissions to an IAM user. The policy includes the following statement: { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::example-bucket/*" }. The engineer wants to ensure that the user can only access objects in the bucket when the request originates from a specific VPC endpoint. Which additional element should the engineer add to the policy?

⚠ Common exam trap

Many candidates confuse network-based conditions like aws:SourceIp with endpoint-specific conditions, when only aws:SourceVpce can precisely limit access to a particular VPC endpoint.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

A condition that checks aws:SourceVpce against the VPC endpoint ID.

The aws:SourceVpce condition key is used to allow or deny access based on the VPC endpoint through which the request is made. By including this condition in the IAM policy, the engineer ensures that only requests routed through the specified VPC endpoint can access the S3 objects. This is a common pattern for restricting access to private network paths.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
A condition that checks aws:RequestedRegion against the region of the VPC endpoint.
Why it's wrong here
The aws:RequestedRegion condition restricts access to a specific AWS region, but it does not verify that the request comes through a VPC endpoint. An attacker could still access the bucket from within the same region using the public internet, so this condition does not satisfy the requirement to restrict access to a specific VPC endpoint.
✗
A condition that checks aws:PrincipalOrgID against the organization ID.
Why it's wrong here
The aws:PrincipalOrgID condition restricts access to principals within a specific AWS Organization, but it does not ensure that requests originate from a VPC endpoint. This condition is useful for cross-account access control but does not address the requirement to limit access based on the network path through a VPC endpoint.
✗
A condition that checks aws:SourceIp against the VPC CIDR range.
Why it's wrong here
The aws:SourceIp condition checks the IP address of the requester, but requests through a VPC endpoint use private IP addresses from the VPC. While this could restrict access to the VPC's CIDR, it does not specifically enforce that the request comes through a VPC endpoint, and it may not work reliably with S3 gateway endpoints.
✓
A condition that checks aws:SourceVpce against the VPC endpoint ID.
Why this is correct
The aws:SourceVpce condition key can be used to restrict access to requests that come through a specific VPC endpoint. Adding this condition ensures that the user can only access objects when the request originates from that endpoint, meeting the requirement to limit access to a specific VPC endpoint.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SCS-C02 Identity and Access Management Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question