Which statement about S3 bucket policies and S3 object ACLs on ECS is correct?

Question

Options

• AS3 bucket policies and S3 object ACLs can be used simultaneously on the same object.
• BS3 object ACLs are ignored if S3 bucket policies are already configured for the same object.
• CS3 bucket policies are ignored if S3 object ACLs are already configured for the same object.
• DS3 bucket policies and S3 object ACLs must be configured to grant the same permissions for them to

• A
  75% (44)
• B
  5% (3)
• C
  5% (3)
• D
  15% (9)

Explanation

Option A is correct because AWS evaluates S3 bucket policies and S3 object ACLs independently and simultaneously - both mechanisms are active at the same time, and access is granted if either one allows it (provided neither issues an explicit DENY). They are complementary layers of access control, not mutually exclusive.

B and C are both wrong for the same reason: neither mechanism "ignores" the other. AWS always evaluates all applicable policies (bucket policy, object ACL, IAM policies, etc.) together; disabling or ignoring one based on the presence of another is not how S3 authorization works.

D is wrong because the permissions do not need to match - access is granted by a union of what's allowed across policies, not by requiring identical grants in both. You'd only be blocked if there's an explicit DENY somewhere in the chain.

Memory tip: Think of bucket policies and object ACLs as two bouncers at the same door - both are always checking IDs simultaneously, and getting a "yes" from either one (with no "no" from either) lets you in. They cooperate, not compete.

No community discussion yet for this question.