nerdexam
Amazon

SCS-C02 · Question #92

A security engineer is configuring account-based access control (ABAC) to allow only specific principals to put objects into an Amazon S3 bucket. The principals already have access to Amazon S3. The…

The correct answer is A. The principal's identity-based policy grants access to put objects into the S3 bucket with no C. The S3 bucket's resource policy does not deny access to put objects. In AWS IAM, a PutObject succeeds when an identity-based policy grants access and the resource policy contains no explicit Deny, because AWS evaluates allow from either policy source unless a Deny overrides it.

Submitted by ashley.k· Mar 6, 2026Identity and Access Management

Question

A security engineer is configuring account-based access control (ABAC) to allow only specific principals to put objects into an Amazon S3 bucket. The principals already have access to Amazon S3. The security engineer needs to configure a bucket policy that allows principals to put objects into the S3 bucket only if the value of the Team tag on the object matches the value of the Team tag that is associated with the principal. During testing, the security engineer notices that a principal can still put objects into the S3 bucket when the tag values do not match. Which combination of factors are causing the PutObject operation to succeed when the tag values are different? (Choose two.)

Options

  • AThe principal's identity-based policy grants access to put objects into the S3 bucket with no
  • BThe principal's identity-based policy overrides the condition because the identity-based policy
  • CThe S3 bucket's resource policy does not deny access to put objects.
  • DThe S3 bucket's resource policy cannot allow actions to the principal.
  • EThe bucket policy does not apply to principals in the same zone of trust.

How the community answered

(20 responses)
  • A
    70% (14)
  • B
    5% (1)
  • D
    5% (1)
  • E
    20% (4)

Why each option

In AWS IAM, a PutObject succeeds when an identity-based policy grants access and the resource policy contains no explicit Deny, because AWS evaluates allow from either policy source unless a Deny overrides it.

AThe principal's identity-based policy grants access to put objects into the S3 bucket with noCorrect

The principal's identity-based policy independently grants s3:PutObject, and AWS policy evaluation allows the action if either the identity-based or resource-based policy permits it without an explicit Deny present.

BThe principal's identity-based policy overrides the condition because the identity-based policy

Identity-based policies do not override resource-based policies; AWS evaluates both, and access is granted if either grants permission without a Deny.

CThe S3 bucket's resource policy does not deny access to put objects.Correct

The S3 bucket policy uses a Condition to allow access only when tags match, but without an explicit Deny for mismatched tags, the absence of an allow in the bucket policy does not block access that is already permitted by the identity-based policy.

DThe S3 bucket's resource policy cannot allow actions to the principal.

S3 bucket resource policies can explicitly allow or deny actions to any principal, including those in the same account; this statement is factually incorrect.

EThe bucket policy does not apply to principals in the same zone of trust.

There is no concept of 'zone of trust' that exempts principals from bucket policy conditions; same-account principals are subject to bucket policy rules.

Concept tested: ABAC policy evaluation logic with resource and identity policies

Source: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html

Topics

#ABAC#S3 bucket policy#IAM policy evaluation#tag-based conditions

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SCS-C02 Practice