These questions are independently created for study purposes. They are not official AWS exam questions, actual exam questions, leaked questions, or exam dumps.
SAA-005
You want internal users to be able to read only a specific prefix within an S3 bucket. From a least-privilege perspective, which design is the most appropriate?
Choices
Explanation and answer
Read the explanation and correct answer (spoiler — try answering first)
Correct answer: B. Attach an IAM policy that allows s3:GetObject on objects under the target prefix.
Explanation
When the requirement is to read only a specific prefix, the least-privilege approach is to limit Resource to the target prefix and Action to s3:GetObject.
Per-choice explanations
A. Make the S3 bucket public.
Incorrect. Making the bucket public creates unnecessary exposure.
B. Attach an IAM policy that allows s3:GetObject on objects under the target prefix.
Correct. It limits the scope and the action.
C. Share the AWS account root user credentials.
Incorrect. Sharing root user credentials must always be avoided.
D. Allow s3:* on the entire target bucket.
Incorrect. s3:* includes operations beyond read and is excessive.
Practical Use
S3 access control implements least privilege by narrowing Resource to the prefix level and Action to only the required operations. When internal users need to read only objects under a specific prefix, the IAM policy should limit Resource to `arn:aws:s3:::bucket/prefix/*` and Action to `s3:GetObject` only. Because other prefixes in the bucket and write or delete operations remain denied by the policy, the blast radius of accidental operations and permission abuse is structurally reduced. In design, the distinction between IAM policies (identity-based) and S3 bucket policies (resource-based) is also important. IAM policies are easier when delegating permissions to specific IAM users or roles within the same account, and bucket policies are appropriate for cross-account access or when enforcing a "common policy for the bucket." When both exist at the same time, build the policy with the evaluation logic in mind that an explicit Deny takes top priority. Furthermore, on ListBucket you can limit `s3:prefix` in the Condition of `s3:ListBucket` permission so that objects outside the prefix do not appear in listings. On SAA-C03, this pattern frequently appears in contexts such as "let users read only a specific prefix" or "keep exposure minimal." Distractors include granting `s3:*`, sharing root credentials, and making the entire bucket public — the three typical patterns of excessive permissions, misuse of public design, and direct root use — all of which conflict with IAM best practices.