A security engineer must troubleshoot an administrator's inability to make an existing Amazon S3 bucket public in an account that is part of an organization n AWS Organizations. The administrator…

Question

Options

• AReview the cross-account role permissions and the S3 bucket policy Verify that the Amazon S3
• BReview the role permissions m the master account and ensure it has sufficient privileges to
• CFilter AWS CloudTrail logs for the master account to find the original deny event and update the
• DEvaluate the SCPs covering the member account and the permissions boundary of the role in the
• EEnsure the S3 bucket policy explicitly allows the s3 PutBucketPublicAccess action for the role m

• A
  17% (5)
• B
  41% (12)
• C
  31% (9)
• D
  10% (3)

Explanation

Options B and E address the two most likely failure points in a cross-account role scenario: the source role's IAM permissions and the target resource's explicit allow policy. When an administrator assumes a role from the master account into a member account, that assumed role must have sufficient IAM privileges in its own policy (B) - if s3:PutBucketPublicAccess isn't granted there, the request fails before AWS even evaluates the bucket policy. Additionally, for cross-account access to S3, the bucket policy must explicitly allow the action for the external role (E), because the default implicit deny blocks cross-account principals even when the caller has IAM permissions on their side.

Why the distractors are wrong:

• A overlaps conceptually with B and E but is less precise - "verify the bucket policy" is addressed by E, and "cross-account role permissions" doesn't focus where the actual gap is.
• C is wrong because the deny event would appear in the member account's CloudTrail, not the master account's; filtering the master account logs won't surface the root cause.
• D is a tempting distractor - SCPs are a real concern in Organizations - but SCPs restrict what member account principals can do, not cross-account assumed roles entering from outside; the immediate denial here points to IAM/bucket policy gaps, not an SCP.

Memory tip: Think "IAM sandwich" - for cross-account S3 actions, you need the role's IAM policy (B) on one side and the bucket resource policy (E) on the other; both slices must allow the action or the request fails.

No community discussion yet for this question.