SCS-C02 Question 312
Single answerAn organization has created an IAM policy to grant specific permissions to a group of developers. The policy is as follows:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::example-bucket/*",
"Condition": {
"StringEquals": {
"s3:x-amz-acl": "private"
}
}
}
]
}
A developer reports that their attempt to upload an object to the example-bucket fails. Upon investigation, the developer's IAM role is correctly assigned the policy. What is the most likely reason for this failure?
- A
The 'Principal' element is missing in the policy.
- B
The policy does not grant 's3:PutObjectAcl' permission.
- C
The condition requires the object to have an ACL of 'private', but the developer's request did not meet this requirement.
- D
The 'Action' element should include all possible S3 actions, not just 's3:PutObject'.
Show answer and explanation
Correct answer: C
Explanation
The policy explicitly allows the 's3:PutObject' action for objects in the 'example-bucket' only if the 'x-amz-acl' header is set to 'private'. If the developer's request does not meet this condition, the request will fail. This demonstrates the impact of the 'Condition' element in an IAM policy and how it can restrict access based on specific request parameters. The other options are not relevant to the failure in this scenario.
- A. Incorrect.
The 'Principal' element is not required in this case because the policy is attached to an IAM role, which inherently defines the principal.
- B. Incorrect.
While 's3:PutObjectAcl' permission is sometimes needed, it is not required in this specific scenario as the policy only restricts 's3:PutObject' based on a condition.
- C. Correct.
The policy includes a condition requiring that the 'x-amz-acl' header in the request equals 'private'. If the developer's request did not include this header or had a different value, the request would fail.
- D. Incorrect.
It is unnecessary to include all possible actions in the 'Action' element. Limiting the action to 's3:PutObject' is sufficient for the intended purpose of this policy.