SAA-C03 Q484 · IAM

Question

A company operates an online photo-sharing service and stores data in AWS Account A in a centralized Amazon S3 bucket. The company wants to grant a second AWS account named Account B access to the centralized S3 bucket. The company owns Account B. Which solution will meet these requirements?

Accepted Answer

**Option D: Create a bucket policy that grants Account B permission to access the centralized S3 bucket in Account A.**

This is the standard, simplest, and most direct method for cross-account S3 access. Here's why:

1. **Requirement: Grant Account B access to Account A's S3 bucket** — A bucket policy is a resource-based policy attached directly to the S3 bucket. Resource-based policies support specifying a **Principal** from another AWS account (using the account ID or specific IAM ARN).

2. **How it works:** Account A adds a bucket policy on the centralized bucket that includes Account B's account ID (or specific IAM roles/users) as an allowed Principal for the desired actions (e.g., `s3:GetObject`, `s3:PutObject`). Account B's IAM entities then also need IAM policies allowing them to a

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips