SCS-C02 Threat Detection and Incident Response Practice Question

Exhibit

Refer to the exhibit.

Resource: "arn:aws:ec2:us-east-1:123456789012:instance/*"
Condition: {
  "StringEquals": {
    "aws:SourceVpce": "vpce-0a1b2c3d4e5f67890"
  }
}

The above condition is added to an S3 bucket policy to restrict access to a specific VPC endpoint. An EC2 instance in the same VPC is unable to access the bucket. What is the most likely reason?

⚠ Common exam trap

The trap here is that candidates focus on the VPC endpoint condition (aws:SourceVpce vs aws:SourceVpc) and overlook the fundamental requirement that the Resource ARN must match the S3 bucket, not the EC2 instance.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The resource ARN in the policy is for EC2, not for S3

The resource ARN in the policy must reference the S3 bucket (e.g., arn:aws:s3:::bucket-name/*), not an EC2 resource. If the ARN is for EC2, the policy will not apply to S3 operations, causing the EC2 instance to be denied access regardless of the VPC endpoint condition. S3 bucket policies only take effect when the Resource element specifies the S3 bucket ARN.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The condition should use aws:SourceVpc instead of aws:SourceVpce
Why it's wrong here
The correct condition key depends on the type of VPC endpoint used for S3. For a gateway endpoint, aws:SourceVpc is appropriate because requests originate from a particular VPC, but for an interface endpoint, aws:SourceVpce is needed to restrict to a specific endpoint ID. Without knowing whether the S3 access uses a gateway or interface endpoint, you cannot assert that aws:SourceVpce is wrong. In any case, the resource ARN error is the primary misconfiguration, not the condition key choice.
✗
The EC2 instance does not have a public IP address
Why it's wrong here
Access to S3 through a VPC endpoint is routed over the private network and does not require a public IP address on the EC2 instance. Even a private instance can reach S3 via the endpoint if the bucket policy, endpoint policy, and route tables are correctly configured. The failure is due to the malformed resource ARN in the bucket policy, not the absence of a public IP.
✗
The VPC endpoint policy does not allow the s3:GetObject action
Why it's wrong here
The exhibit does not include a VPC endpoint policy, so this assertion is unfounded. Even if an endpoint policy existed, it would be evaluated separately from the bucket policy; the bucket policy itself is invalid because its Resource element references an EC2 ARN. A valid bucket policy must identify the S3 bucket or object ARN, not the EC2 instance ARN, so the statement cannot explain the access failure.
✓
The resource ARN in the policy is for EC2, not for S3
Why this is correct
S3 bucket policies are resource-based policies attached to a bucket, so the Resource field must use the S3 ARN format arn:aws:s3:::bucket-name (or an object key pattern). Using an EC2 resource ARN, such as arn:aws:ec2:region:account-id:instance/instance-id, makes the policy invalid for S3 and therefore it does not grant or restrict access. This is the fundamental reason the bucket policy fails, regardless of any condition keys or endpoint configuration.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SCS-C02 Threat Detection and Incident Response Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question