Based on the following bucket policy configured on an ECS cluster, what can user1 do?

Question

Options

• Auser1 can modify any object that is contained in bucket1 from anywhere except from IP range
• Buser1 can modify any object that is contained in bucket1 only from IP range 10.56.81.0/24
• Cuser1 can read any object that is contained in bucket1 only from IP range 10.56.81.0/24
• Duser1 can read any object that is contained in bucket1 from anywhere except from IP range

• A
  3% (1)
• B
  10% (3)
• C
  19% (6)
• D
  68% (21)

Explanation

Option D is correct because the bucket policy grants user1 read-only access (e.g., GetObject) and uses an IP condition to deny access from the 10.56.81.0/24 range - meaning user1 can read from any IP except that subnet.

Why the distractors are wrong:

• A & B are wrong because the policy grants read permissions (like GetObject), not write/modify permissions (like PutObject or DeleteObject) - no modification capability exists.
• C is wrong about the direction of the IP restriction: the IP range 10.56.81.0/24 is the excluded range, not the only allowed range. C and B both flip the logic of the condition.

Memory tip: When you see an IP-based deny condition in a bucket policy, think of it as a blocklist - everything is allowed except the listed range. If the condition were an allow-only, it would be an allowlist (only that range works). The word "except" in the answer is your signal that a Deny or NotIpAddress condition is in play.

No community discussion yet for this question.