Fixing S3 IAM Policy Missing ListBucket Permission

Exhibit

Refer to the exhibit.
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "203.0.113.0/24"
        }
      }
    }
  ]
}

Refer to the exhibit. A security engineer is reviewing an IAM policy attached to a user. The policy is intended to allow the user to get and put objects in the S3 bucket 'example-bucket' only from the IP range 203.0.113.0/24. However, the user reports that they are unable to put objects from an IP within that range. What is the most likely cause of this issue?

Quick Answer

The answer is a missing separate statement for s3:ListBucket on the bucket resource. While the IAM policy correctly grants s3:GetObject and s3:PutObject on the object ARN (arn:aws:s3:::example-bucket/*) and applies the IP condition, the AWS CLI and SDK often require the ListBucket permission on the bucket itself (arn:aws:s3:::example-bucket) to resolve object keys before performing uploads. Without it, the put operation fails even from an allowed IP. On the AWS Certified Security Specialty SCS-C02 exam, this scenario tests your understanding of how S3 permissions interact with API calls—specifically that object-level actions like PutObject can implicitly depend on bucket-level ListBucket for client-side operations. A common trap is assuming the IP condition is misconfigured, but the real issue is the missing list permission. Memory tip: remember the "bucket vs. object ARN" rule—ListBucket lives on the bucket, Get/Put live on the objects, and both are often needed for a successful upload.

⚠ Common exam trap

The trap here is that candidates focus on the IP condition syntax or resource ARN format and overlook the common requirement for an explicit s3:ListBucket permission when performing object operations via the AWS CLI or SDK.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The policy lacks a separate statement to allow 's3:ListBucket' on the bucket resource.

The policy only grants s3:GetObject and s3:PutObject actions on the bucket's objects (arn:aws:s3:::example-bucket/*), but does not include a separate statement allowing s3:ListBucket on the bucket resource (arn:aws:s3:::example-bucket). Without s3:ListBucket, the user cannot list the bucket's contents, which is often required by the AWS CLI or SDK to resolve object keys before performing put operations. The IP condition is correctly applied, so the issue is the missing list permission.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The condition key should be 'aws:sourceIp' (lowercase 's').
Why it's wrong here
The condition key 'aws:SourceIp' is case-sensitive and must have a capital 'S'.
✗
The policy should use the 'NotIpAddress' condition operator instead of 'IpAddress'.
Why it's wrong here
Using 'NotIpAddress' would deny access from the specified IP range, not allow it.
✗
The resource ARN should be 'arn:aws:s3:::example-bucket' without the '/*' suffix.
Why it's wrong here
The resource ARN for GetObject and PutObject must include the object path '/*'.
✓
The policy lacks a separate statement to allow 's3:ListBucket' on the bucket resource.
Why this is correct
For console access, ListBucket is required; without it, the user cannot see the bucket but can still perform PutObject via API. However, the question implies inability to put objects, which could be due to missing ListBucket in some SDK scenarios.

Visual reference

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

1 more way this is tested on SCS-C02

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. Refer to the exhibit. An IAM policy is attached to an IAM user. The user reports that they can upload objects to the S3 bucket but cannot list the contents of the bucket. Which statement explains this behavior?

medium

✓ A.The policy does not include the s3:ListBucket action.
B.The policy includes s3:ListBucket but is missing the bucket ARN.
C.The policy denies the s3:ListBucket action.
D.The policy explicitly denies s3:ListBucket.

Why A: The IAM policy grants the s3:PutObject action, which allows the user to upload objects, but it does not include the s3:ListBucket action. The s3:ListBucket action is required to list the contents of an S3 bucket (e.g., via the ListObjects API call). Without this permission, the user can upload but cannot see the bucket's object listing.

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.