Fixing S3 IAM Policy Missing ListBucket Permission

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:PutObject", "s3:GetObject"],
      "Resource": "arn:aws:s3:::example-bucket/*"
    }
  ]
}

Refer to the exhibit. An IAM policy is attached to an IAM user. The user reports that they can upload objects to the S3 bucket but cannot list the contents of the bucket. Which statement explains this behavior?

⚠ Common exam trap

Candidates often confuse an implicit deny (missing allow) with an explicit deny, or assume that the s3:PutObject action implicitly grants listing permissions, which it does not.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The policy does not include the s3:ListBucket action.

The IAM policy grants the s3:PutObject action, which allows the user to upload objects, but it does not include the s3:ListBucket action. The s3:ListBucket action is required to list the contents of an S3 bucket (e.g., via the ListObjects API call). Without this permission, the user can upload but cannot see the bucket's object listing.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The policy does not include the s3:ListBucket action.
Why this is correct
The attached IAM policy only grants s3:PutObject and s3:GetObject; it does not contain a statement allowing s3:ListBucket. Listing the objects in an S3 bucket is a bucket-level permission that requires s3:ListBucket on the bucket ARN (e.g., arn:aws:s3:::example-bucket). Because no Allow exists for that action, IAM's default-deny rule causes list requests to fail, even though the user can still upload and download objects.
✗
The policy includes s3:ListBucket but is missing the bucket ARN.
Why it's wrong here
This option incorrectly asserts that the policy includes s3:ListBucket, but the policy simply does not contain that action in any statement. Even if it did include s3:ListBucket, the resource would need to be the bucket ARN itself—such as arn:aws:s3:::example-bucket—not an object ARN or a missing value. Since the action is entirely absent, the ARN issue is irrelevant: the user lacks the required permission to list the bucket.
✗
The policy denies the s3:ListBucket action.
Why it's wrong here
IAM policies are evaluated as allow by default; a request is denied only when no applicable Allow exists. The policy in question contains only Allow statements for s3:PutObject and s3:GetObject, and it has no Deny statements, so it does not actively deny s3:ListBucket. The failure to list is an implicit deny caused by the missing Allow, not an explicit denial in the policy.
✗
The policy explicitly denies s3:ListBucket.
Why it's wrong here
An explicit deny for s3:ListBucket would appear as a separate IAM statement with "Effect": "Deny" and "Action": "s3:ListBucket". The exhibit contains no such statement, so the policy does not explicitly deny the action. Explicit deny is significant because it would override any Allow elsewhere, but here the user simply lacks permission because no Allow for s3:ListBucket is present.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

Fixing S3 IAM Policy Missing ListBucket Permission

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question