SCS-C02 Identity and Access Management Practice Question
A security engineer needs to grant a third-party vendor temporary access to an S3 bucket in the company's AWS account. The vendor has its own AWS account and will use its own IAM users. The engineer wants to avoid creating IAM users in the company's account and wants to audit all access. Which solution meets these requirements?
⚠ Common exam trap
The trap here is assuming that AWS RAM can share S3 buckets, when it cannot, or that creating IAM users is acceptable despite the explicit requirement to avoid them.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an IAM role in the company account with a trust policy that allows the vendor's AWS account to assume it, and attach a policy granting access to the S3 bucket.
Cross-account access is best achieved by creating an IAM role in the trusting account that the trusted account can assume. The trust policy names the vendor's account, and the permissions policy grants S3 access. This avoids creating IAM users in the company account and ensures all actions are logged in CloudTrail. Other options either violate security best practices or use unsupported features.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create an IAM role in the company account with a trust policy that allows the vendor's AWS account to assume it, and attach a policy granting access to the S3 bucket.
Why this is correct
This is the standard cross-account access pattern. The role's trust policy specifies the vendor's account as the principal, allowing its IAM users to assume the role via STS. The permissions policy grants S3 access. No IAM users are created in the company account, and all access is audited through CloudTrail, which logs AssumeRole and S3 API calls. This meets all requirements.
- ✗
Use AWS Resource Access Manager (RAM) to share the S3 bucket with the vendor's account.
Why it's wrong here
AWS RAM is used to share resources like VPC subnets, Transit Gateways, and Route 53 Resolver rules, but it does not support sharing S3 buckets. S3 buckets cannot be shared via RAM. The correct cross-account sharing mechanism for S3 is a bucket policy or an IAM role. Therefore, this option is technically invalid for the scenario.
- ✗
Enable S3 public access and provide the vendor with the bucket URL and an access key.
Why it's wrong here
Making the bucket public is a severe security risk and does not provide temporary, auditable access. Sharing an access key is also unsafe and violates the requirement to avoid long-term credentials. This solution would expose data to the internet and does not restrict access to the vendor, nor does it integrate with their AWS account for auditing.
- ✗
Create an IAM user in the company account for each vendor employee and share the credentials securely.
Why it's wrong here
Creating IAM users in the company account violates the requirement to avoid IAM users and introduces long-term credentials that are hard to manage and audit. It also does not leverage the vendor's existing identity system. This approach increases risk and administrative overhead, and it fails to provide the temporary, cross-account access desired.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 1,205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.