SAP-C02 Q59 · Storage

Question

A solutions architect needs to copy data from an Amazon S3 bucket m an AWS account to a new S3 bucket in a new AWS account. The solutions architect must implement a solution that uses the AWS CLI. Which combination of steps will successfully copy the data? (Choose three)

Accepted Answer

This question tests cross-account S3 access where the operation is performed from the **destination account**. Here's why B, D, F work together:

**Step 1 — B: Bucket policy on the source bucket**
The source account must explicitly grant the destination account's user permission to `ListBucket` and `GetObject` on the source bucket. Without this bucket policy, the destination account user has zero access to the source bucket, regardless of their own IAM permissions. Cross-account S3 access requires BOTH the resource policy (bucket policy) AND the requester's IAM policy to allow the action.

**Step 2 — D: IAM policy in the destination account**
The destination account creates an IAM policy for its user granting:
- `s3:ListBucket` + `s3:GetObject` on the **source** bucket (the user needs iden

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

🔒 Security

🎯 Exam Tips