Question
A retail company needs to provide a series of data files to another company, which is its business partner. These files are saved in an Amazon S3 bucket under Account A, which belongs to the retail company. The business partner company wants one of its IAM users, User_DataProcessor, to access the files from its own AWS account (Account B).
Which combination of steps must the companies take so that User_DataProcessor can access the S3 bucket successfully? (Choose two.)
- A. Turn on the cross-origin resource sharing (CORS) feature for the S3 bucket in Account A.
- B. In Account A, set the S3 bucket policy to the following: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": ["s3:GetObject", "s3:ListBucket"], "Resource": [ "arn:aws:s3:::AccountABucketName", "arn:aws:s3:::AccountABucketName/*" ] } ] }
- C. In Account A, set the S3 bucket policy to the following: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": {"AWS": "arn:aws:iam::AccountB:user/User_DataProcessor"}, "Action": ["s3:GetObject", "s3:ListBucket"], "Resource": [ "arn:aws:s3:::AccountABucketName", "arn:aws:s3:::AccountABucketName/*" ] } ] } Correct
- D. In Account B, set the permissions of User_DataProcessor to the following: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": ["s3:GetObject", "s3:ListBucket"], "Resource": [ "arn:aws:s3:::AccountABucketName", "arn:aws:s3:::AccountABucketName/*" ] } ] } Correct
- E. In Account B, set the permissions of User_DataProcessor to the following: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": {"AWS": "arn:aws:iam::AccountB:user/User_DataProcessor"}, "Action": ["s3:GetObject", "s3:ListBucket"], "Resource": [ "arn:aws:s3:::AccountABucketName", "arn:aws:s3:::AccountABucketName/*" ] } ] }
Explanation
C and D are correct. For a user in one account to reach a bucket in another account, both accounts must allow the access. In Account A, the bucket owner adds a bucket policy that names User_DataProcessor from Account B as the Principal and allows the required S3 actions on the bucket and its objects (C). In Account B, the administrator must also grant User_DataProcessor those S3 permissions on Account A's bucket through an identity-based policy (D), because a user can use only the permissions its own account delegates to it. B is wrong because a bucket policy is a resource-based policy and must name a Principal. E is wrong because an identity-based policy attached to a user cannot contain a Principal element. A is wrong because CORS only controls browser cross-origin requests and does not grant any permissions.
