SCS-C02 · Question #162
A company has an application that needs to get objects from an Amazon S3 bucket. The application runs on Amazon EC2 instances. All the objects in the S3 bucket are encrypted with an AWS Key…
The correct answer is A. The IAM instance profile that is attached to the EC2 instances does not allow the s3:ListBucket D. The KMS key policy that encrypts the objects in the S3 bucket does not allow the kms:Decrypt E. The S3 bucket policy does not allow access from the gateway VPC endpoint. A is correct because EC2 instances access S3 through their IAM instance profile - if that role lacks required S3 permissions (such as s3:GetObject or s3:ListBucket), requests will be denied at the IAM authorization layer regardless of anything else. D is correct because objects…
Question
A company has an application that needs to get objects from an Amazon S3 bucket. The application runs on Amazon EC2 instances. All the objects in the S3 bucket are encrypted with an AWS Key Management Service (AWS KMS) customer managed key. The resources in the VPC do not have access to the internet and use a gateway VPC endpoint to access Amazon S3. The company discovers that the application is unable to get objects from the S3 bucket. Which factors could cause this issue? (Choose three.)
Options
- AThe IAM instance profile that is attached to the EC2 instances does not allow the s3:ListBucket
- BThe IAM instance profile that is attached to the EC2 instances does not allow the s3:ListParts
- CThe KMS key policy that encrypts the objects in the S3 bucket does not allow the kms:ListKeys
- DThe KMS key policy that encrypts the objects in the S3 bucket does not allow the kms:Decrypt
- EThe S3 bucket policy does not allow access from the gateway VPC endpoint.
- FThe security group that is attached to the EC2 instances is missing an inbound rule from the S3
How the community answered
(32 responses)- A59% (19)
- B6% (2)
- C25% (8)
- F9% (3)
Explanation
A is correct because EC2 instances access S3 through their IAM instance profile - if that role lacks required S3 permissions (such as s3:GetObject or s3:ListBucket), requests will be denied at the IAM authorization layer regardless of anything else. D is correct because objects encrypted with a KMS customer managed key require the caller to have kms:Decrypt in the KMS key policy; without it, S3 returns the encrypted bytes but the decryption call fails. E is correct because even though a gateway VPC endpoint routes traffic to S3, the S3 bucket policy can still explicitly restrict access to specific VPC endpoints using aws:sourceVpce conditions - if that policy denies or omits the endpoint, requests are rejected.
B (s3:ListParts) is wrong because that permission applies only to listing parts of an in-progress multipart upload, not to reading objects. C (kms:ListKeys) is wrong because that permission is for enumerating available KMS keys in an account - it plays no role in decryption; kms:Decrypt is what's actually needed. F is wrong because EC2 instances initiate outbound connections to S3 - an inbound security group rule from S3 makes no sense, and gateway VPC endpoints operate at the route table level, not the security group layer.
Memory tip: Think in three layers - IAM (who can call what), KMS (who can decrypt), and endpoint/bucket policy (who can reach the bucket through which network path). For encrypted S3 access through a VPC endpoint, all three must align.
Topics
Community Discussion
No community discussion yet for this question.