An Amazon EC2 instance is running in a VPC and needs to download an object from a restricted Amazon S3 bucket. When the DevOps engineer tries to download the object, an AccessDenied error is…

Question

Options

• AThe S3 bucket default encryption is enabled.
• BThere is an error in the S3 bucket policy.
• CThe object has been moved to S3 Glacier.
• DThere is an error in the IAM role configuration.
• ES3 Versioning is enabled.

• A
  4% (1)
• B
  71% (17)
• C
  8% (2)
• E
  17% (4)

Explanation

AccessDenied Error on Amazon S3 Explanation

An S3 bucket policy error (B) can explicitly deny access or fail to grant the necessary permissions for the EC2 instance to retrieve objects, causing an AccessDenied response. Similarly, an IAM role misconfiguration (D) - such as missing s3:GetObject permissions or an incorrect trust policy - would prevent the EC2 instance from authenticating properly to access the restricted bucket. These two are the most common causes of AccessDenied errors because S3 access is controlled through both resource-based policies (bucket policies) and identity-based policies (IAM roles), and a failure in either will block access.

The distractors are incorrect because: default encryption (A) affects how data is stored, not who can access it; S3 Versioning (E) simply tracks object versions and has no impact on access permissions; and objects moved to S3 Glacier (C) would result in an error related to object retrieval/restoration, not an AccessDenied error.

Memory Tip

Think "Who controls access to S3?" - it's always the Bucket Policy (resource side) and the IAM Role (identity side). If either is broken, access is denied. Encryption and versioning are features, not gatekeepers.

No community discussion yet for this question.