SCS-C02 Question 313
Select 3An organization is using an S3 bucket to store sensitive financial documents. The following bucket policy has been created:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": { "AWS": "arn:aws:iam::123456789012:role/FinanceRole" },
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::example-bucket/*"
},
{
"Effect": "Deny",
"Principal": "*",
"Action": "s3:*",
"Resource": "arn:aws:s3:::example-bucket/*",
"Condition": {
"IpAddress": {
"aws:SourceIp": "203.0.113.0/24"
}
}
}
]
}
Which of the following statements accurately describe the impact of this policy?
- A
The FinanceRole can access objects in the bucket from any IP address.
- B
All users are denied access to the bucket if they are connecting from the IP range 203.0.113.0/24.
- C
The FinanceRole cannot access the bucket if connecting from the IP range 203.0.113.0/24.
- D
The bucket policy allows any user to upload objects to the bucket.
- E
The Deny statement takes precedence over the Allow statement due to the explicit deny.
Show answer and explanation
Correct answers: A, B, E
Explanation
This bucket policy uses two statements: an explicit allow for the FinanceRole to perform the s3:GetObject action on the bucket, and an explicit deny for all users attempting to access the bucket from a specific IP range. Explicit deny always overrides allow in AWS policies. Therefore, users from the specified IP range are denied access, and the FinanceRole retains access unless connecting from the denied IP range.
- A. Correct.
Correct. The FinanceRole is explicitly allowed access to objects in the bucket without any condition restricting its access. This means it can access objects from any IP address unless explicitly denied.
- B. Correct.
Correct. The deny statement explicitly denies all users (Principal: *) access to the bucket if they are connecting from the IP range 203.0.113.0/24.
- C. Incorrect.
Incorrect. The FinanceRole is not explicitly denied access based on its IP address in the policy provided. The explicit allow for FinanceRole overrides any implicit denies.
- D. Incorrect.
Incorrect. There is no statement in the policy that allows any user to upload objects to the bucket. The policy only governs object access (s3:GetObject).
- E. Correct.
Correct. In AWS policies, explicit deny statements take precedence over allow statements, which means the deny condition for the IP range will apply to all users, even if they have an allow statement.