SOA-C02 Question 180
Select 3A company is experiencing issues where an IAM user is unable to access an S3 bucket. The SysOps Administrator is tasked with troubleshooting the issue. The Administrator has already reviewed the bucket policy and confirmed that it allows the required actions for the user. Which of the following steps should the Administrator take to further troubleshoot the issue?
- A
Use the IAM Policy Simulator to check if the user's permissions allow access to the S3 bucket.
- B
Enable AWS CloudTrail logging to track API calls made by the user and identify potential issues.
- C
Use IAM Access Analyzer to identify any external access issues related to the S3 bucket.
- D
Check the user's IAM inline policies and attached managed policies for permissions related to the S3 bucket.
- E
Inspect the S3 bucket's default encryption settings to ensure they match the user's credentials.
Show answer and explanation
Correct answers: A, B, D
Explanation
When troubleshooting access issues for an IAM user, it is important to ensure that the user's permissions allow the required actions. The IAM Policy Simulator can validate the user's effective permissions, while AWS CloudTrail logs can provide insights into denied API calls. Verifying the user's inline and managed policies ensures there are no missing permissions. IAM Access Analyzer and bucket encryption settings, while useful in other scenarios, are not directly applicable in this case.
- A. Correct.
Using the IAM Policy Simulator is a recommended way to verify if the user's IAM policies allow access to the required AWS resources. This tool helps simulate API calls and permissions, making it a key step in troubleshooting access issues.
- B. Correct.
Enabling AWS CloudTrail logging is critical for tracking API calls made by the user. By reviewing the logs, the Administrator can identify denied requests and pinpoint the root cause of the issue.
- C. Incorrect.
IAM Access Analyzer is mainly used to identify external access or unintended public access to resources. While useful, it is not directly relevant in troubleshooting access issues for an IAM user within the same AWS account.
- D. Correct.
Checking the user's IAM inline policies and attached managed policies is crucial because access to the S3 bucket may be restricted at the IAM policy level. This step ensures that the user has the necessary permissions.
- E. Incorrect.
Inspecting the S3 bucket's default encryption settings is not relevant to the user's access issue. Default encryption only affects how objects are stored and secured, not access permissions.