Bucket policies for access control in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

What happens when a bucket policy denies all public access?

You have an S3 bucket with a policy that explicitly denies any request where the source IP is not from your corporate network. What will happen if someone tries to access the bucket from outside your network?

A The request is allowed but logged for review.

B The request is denied and the user receives an access denied error.

C The request is allowed only if the user is authenticated with AWS credentials.

D The request is redirected to a public read-only copy of the bucket.

💡 Hint

Think about what a deny statement in a bucket policy does to requests that do not meet the condition.

A deny statement in a bucket policy overrides any allow. If the request comes from outside the allowed IP range, it is blocked and the user gets an access denied error.

❓ Configuration

intermediate

Which bucket policy snippet grants read-only access to a specific IAM user?

Given an IAM user with ARN arn:aws:iam::123456789012:user/Alice, which bucket policy snippet correctly grants read-only access to the bucket example-bucket?

A { "Effect": "Allow", "Principal": {"AWS": "arn:aws:iam::123456789012:user/Alice"}, "Action": ["s3:GetObject"], "Resource": "arn:aws:s3:::example-bucket/*" }

B { "Effect": "Allow", "Principal": "*", "Action": ["s3:ListBucket"], "Resource": "arn:aws:s3:::example-bucket" }

C { "Effect": "Allow", "Principal": {"AWS": "arn:aws:iam::123456789012:user/Alice"}, "Action": ["s3:PutObject"], "Resource": "arn:aws:s3:::example-bucket/*" }

D { "Effect": "Deny", "Principal": {"AWS": "arn:aws:iam::123456789012:user/Alice"}, "Action": ["s3:DeleteObject"], "Resource": "arn:aws:s3:::example-bucket/*" }

💡 Hint

Read-only access means allowing only actions that retrieve objects, not modify or delete.

Option A allows the IAM user Alice to perform the s3:GetObject action on all objects in the bucket, which is read-only access. Other options either allow wrong actions or deny access.

❓ Architecture

advanced

How to design a bucket policy to allow public read access only to a specific folder?

You want to make only the public/ folder inside your S3 bucket my-bucket publicly readable, but keep the rest private. Which bucket policy achieves this?

A { "Effect": "Deny", "Principal": "*", "Action": ["s3:GetObject"], "Resource": "arn:aws:s3:::my-bucket/private/*" }

B { "Effect": "Allow", "Principal": "*", "Action": ["s3:GetObject"], "Resource": "arn:aws:s3:::my-bucket/*" }

C { "Effect": "Allow", "Principal": "*", "Action": ["s3:GetObject"], "Resource": "arn:aws:s3:::my-bucket/public/*" }

D { "Effect": "Allow", "Principal": "*", "Action": ["s3:ListBucket"], "Resource": "arn:aws:s3:::my-bucket/public" }

💡 Hint

Focus on granting access only to the objects inside the public/ folder.

Option C allows anyone to read objects only inside the public/ folder by specifying the resource ARN with the folder prefix. Other options either allow too much or deny incorrectly.

❓ security

advanced

What is the effect of a bucket policy with a Deny statement on MFA delete?

You have a bucket policy that denies all s3:DeleteObject actions unless the request includes MFA authentication. What happens if a delete request is made without MFA?

A The delete request is denied regardless of the user's permissions.

B The delete request is allowed if the user has IAM delete permissions.

C The delete request is queued until MFA is provided.

D The delete request is logged but still processed.

💡 Hint

Consider how explicit deny statements affect requests.

An explicit deny in a bucket policy overrides any allow. Without MFA, the delete request is blocked even if the user has permissions.

✅ Best Practice

expert

Which bucket policy best follows the principle of least privilege for cross-account read access?

You want to allow read-only access to your bucket secure-bucket for a specific AWS account 987654321098. Which bucket policy snippet follows the principle of least privilege?

A { "Effect": "Allow", "Principal": {"AWS": "arn:aws:iam::987654321098:user/AnyUser"}, "Action": ["s3:*"], "Resource": "arn:aws:s3:::secure-bucket/*" }

B { "Effect": "Allow", "Principal": {"AWS": "arn:aws:iam::987654321098:root"}, "Action": ["s3:ListBucket"], "Resource": "arn:aws:s3:::secure-bucket" }

C { "Effect": "Allow", "Principal": "*", "Action": ["s3:GetObject", "s3:ListBucket"], "Resource": "arn:aws:s3:::secure-bucket" }

D { "Effect": "Allow", "Principal": {"AWS": "arn:aws:iam::987654321098:root"}, "Action": ["s3:GetObject"], "Resource": "arn:aws:s3:::secure-bucket/*" }

💡 Hint

Least privilege means granting only the exact permissions needed to the correct principal.

Option D grants only read object access to the entire account root principal, which is appropriate for cross-account read access. Option D is too open, A grants all actions, and D only allows listing but not reading objects.