What does this policy define?

A sysadmin has created the below mentioned policy on an S3 bucket named cloudacademy. What does this
policy define?
“Statement”: [{
“Sid”: “Stmt1388811069831”,
“Effect”: “Allow”,
“Principal”: { “AWS”: “*”},
“Action”: [ “s3:GetObjectAcl”, “s3:ListBucket”],
“Resource”: [ “arn:aws:s3:::cloudacademy]
}]

A sysadmin has created the below mentioned policy on an S3 bucket named cloudacademy. What does this
policy define?
“Statement”: [{
“Sid”: “Stmt1388811069831”,
“Effect”: “Allow”,
“Principal”: { “AWS”: “*”},
“Action”: [ “s3:GetObjectAcl”, “s3:ListBucket”],
“Resource”: [ “arn:aws:s3:::cloudacademy]
}]

A.
It will make the cloudacademy bucket as well as all its objects as public

B.
It will allow everyone to view the ACL of the bucket

C.
It will give an error as no object is defined as part of the policy while the action defines the rule about
the object

D.
It will make the cloudacademy bucket as public

Explanation:
A sysadmin can grant permission to the S3 objects or the buckets to any user or make objects public using the
bucket policy and user policy. Both use the JSON-based access policy language. Generally if the user is defining
the ACL on the bucket, the objects in the bucket do not inherit it and vice a versa. The bucket policy can be
defined at the bucket level which allows the objects as well as the bucket to be public with a single policy
applied to that bucket. In the sample policy the action says “S3:ListBucket” for effect Allow on Resource
arn:aws:s3:::cloudacademy. This will make the cloudacademy bucket public.
“Statement”: [{
“Sid”: “Stmt1388811069831”,
“Effect”: “Allow”,
“Principal”: { “AWS”: “*” },
“Action”: [ “s3:GetObjectAcl”, “s3:ListBucket”],
“Resource”: [ “arn:aws:s3:::cloudacademy]
}]



Leave a Reply 0

Your email address will not be published. Required fields are marked *


Blahidos

Blahidos

Both the answer and the explanation is incorrect; answer should be C. s3:GetObjectAcl requires an object as a resource but only a bucket is stated.

venkat sai

venkat sai

I agree with you.

alians07

alians07

Perfect Answer.

s3:GetObjectAcl will require “Resource”: [ “arn:aws:s3:::cloudacademy/*]
s3:ListBucket will require “Resource”: [ “arn:aws:s3:::cloudacademy]

James

James

Yes,I tested it, Answer should be C

Yogi

Yogi

Tested and got an error while saving the above S3 bucket policy:
” Action does not apply to any resource(s) in statement – Action “s3:GetObject” in Statement “Stmt123456788” “

MUBARAK NASAR

MUBARAK NASAR

Correct Answer is C

It will give an error as no object is defined as part of the policy while the action defines the rule about the object

nosoul

nosoul

change “Resource”: [ “arn:aws:s3:::cloudacademy] to “Resource”: [ “arn:aws:s3:::cloudacademy”] ,is the answer D ?

Ken

Ken

Still C, tested