Study. uk . com
  1. Home
  2. All questions
  3. Question 3

AWS Certified Solutions Architect study material · question 3 of 500

Within a single AWS account, a bucket policy grants s3:GetObject to a role that has no S3 permissions in its own identity-based policy. What happens when the role calls GetObject?

  1. The call fails, because bucket policies apply only across accounts
  2. The call succeeds, because a resource-based grant is sufficient inside one account
  3. The call fails, because an identity-based policy must also allow it
  4. The call succeeds only if a permissions boundary allows it
Show the answer

Answer: B. The call succeeds, because a resource-based grant is sufficient inside one account

Inside one account, identity-based and resource-based permissions form a union, so an allow in the bucket policy alone permits the action.

Source: Policies and permissions in AWS Identity and Access Managem… (Amazon Web Services) — Resource-based policies

Challenge yourself on this topic → Study as cards