A security engineer is troubleshooting an AWS Lambda function that is named MyLambdaFunction. The function is encountering an error when the function attempts to read the objects in an Amazon S3…

Question

Exhibit

Options

• ARemove the Condition element. Change the Principal element to the following:
• BChange the Action element to the following:
• CChange the Resource element to "arn:aws:s3:::DOC-EXAMPLE- BUCKET/*''.
• DChange the Resource element to "arn:aws:lambda:::function:MyLambdaFunction". Change the

• A
  4% (1)
• B
  4% (1)
• C
  82% (23)
• D
  11% (3)

Explanation

Option C is correct because S3 bucket policies distinguish between bucket-level resources (arn:aws:s3:::DOC-EXAMPLE-BUCKET) and object-level resources (arn:aws:s3:::DOC-EXAMPLE-BUCKET/*). The s3:GetObject action required to read objects operates at the object level, so the Resource ARN must include the /* wildcard - without it, the policy grants no permission to access the actual objects inside the bucket.

Option A is wrong because the issue isn't the Principal or Condition - even with the Lambda's identity correctly specified, the missing /* on the Resource still prevents object access. Option B is wrong because the Action isn't the problem; the correct action (s3:GetObject) already targets reads, and no action change fixes a misconfigured Resource. Option D is wrong because S3 bucket policies reference S3 resources, not Lambda ARNs - placing a Lambda function ARN in an S3 Resource element is invalid and nonsensical.

Memory tip: Think "bucket vs. bucket contents" - :::BUCKET controls the bucket itself (e.g., s3:ListBucket), while :::BUCKET/* controls the objects inside. Object-level actions always need the /*.

No community discussion yet for this question.