SAA-C03 Q185 · IAM

Question

A company stores data in a centralized S3 bucket in Account A. It needs to grant Account B access to this bucket. Both accounts belong to the company. Which solution meets this requirement?

Accepted Answer

**Option D: Create a bucket policy granting Account B access to the bucket in Account A.**

This is the standard, most straightforward approach for cross-account S3 access. Here's why:

1. **Requirement: Grant Account B access to Account A's S3 bucket** → A bucket policy is a **resource-based policy** attached directly to the S3 bucket. It can specify principals from other AWS accounts using their account ID or IAM ARNs.

2. **How it works:** The bucket policy in Account A includes a `Principal` field that references Account B's account ID (e.g., `arn:aws:iam::AccountB-ID:root`). This explicitly authorizes Account B's users/roles to perform specified S3 actions on the bucket.

3. **Cross-account access model:** In AWS, cross-account access to S3 can be achieved through:
   - **Resource-bas

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips