After a recent security audit involving Amazon S3, a company has asked assistance reviewing its S3 buckets to determine whether data is properly secured. The first S3 bucket on the list has the follow

Question

Options

• AYes, the bucket policy makes the whole bucket publicly accessible despite now the S3 bucket
• BYes, none of the data in the bucket is publicity accessible, regardless of how the S3 bucket ACL
• CNo, the IAM user policy would need to be examined first to determine whether any data is publicly
• DNo, the S3 bucket ACL and object ACLs need to be examined first to determine whether any data

• A
  71% (30)
• B
  10% (4)
• C
  5% (2)
• D
  14% (6)

Explanation

Option A is correct because a bucket policy granting s3:GetObject to Principal: "*" makes the entire bucket publicly accessible, and this policy-level permission applies regardless of how the S3 bucket ACL or individual object ACLs are configured - you don't need to examine anything else to confirm the data is exposed.

Why the distractors are wrong:

• B is incorrect because it claims the data is not publicly accessible, which directly contradicts a policy that grants public read access to all principals.
• C is incorrect because IAM user policies are irrelevant here - bucket policies operate independently of IAM policies, and a Principal: "*" grant doesn't require an IAM identity at all.
• D is incorrect because ACLs are unnecessary to examine once a bucket policy already grants public access; the policy alone is sufficient to confirm public exposure.

Memory tip: Think of S3 access as a union of permissions - if any policy (bucket policy, ACL, IAM) grants access, access is allowed. A bucket policy with "Principal": "*" is the most direct path to public exposure and trumps the need to audit ACLs or IAM policies for that determination.

No community discussion yet for this question.