DVA-C02 Question 137
Single answerYou are developing an application that stores files in an S3 bucket. The application runs on an EC2 instance with an attached IAM role. The S3 bucket has a resource-based policy allowing 's3:GetObject' permissions for the IAM role. The IAM role's inline policy denies all actions on S3 resources. What will happen when the application tries to read an object from the S3 bucket?
- A
The application will successfully read the object because the S3 bucket's resource-based policy allows it.
- B
The application will fail to read the object because the IAM role's policy explicitly denies S3 access.
- C
The application will successfully read the object because the IAM role's attached policy does not override resource-based policies.
- D
The application will fail to read the object because the S3 bucket's resource-based policy does not include the EC2 instance's IAM role.
Show answer and explanation
Correct answer: B
Explanation
In AWS, access is determined by evaluating all applicable policies (resource-based, identity-based, and service policies). If any applicable policy explicitly denies access, that deny takes precedence over any allow. In this case, the IAM role's inline policy explicitly denies all S3 actions, so the application cannot read the object from the S3 bucket, even though the bucket's resource-based policy allows it.
- A. Incorrect.
Incorrect. Resource-based policies allow access, but IAM identity policies (attached to roles) are also evaluated. A deny in an IAM role policy overrides any allow in a resource-based policy.
- B. Correct.
Correct. Explicit denies in IAM policies take precedence over any allow in resource-based policies, which results in the application failing to access the S3 bucket.
- C. Incorrect.
Incorrect. IAM role policies and resource-based policies are evaluated together, but an explicit deny in any policy (such as the IAM role's policy) takes precedence.
- D. Incorrect.
Incorrect. The S3 bucket's resource-based policy explicitly allows the IAM role to access it, but the explicit deny in the IAM role's inline policy prevents access.