A sysadmin has created the below mentioned policy on an S3 bucket named cloudacademy. What does this
policy define?
“Statement”: [{
“Sid”: “Stmt1388811069831”,
“Effect”: “Allow”,
“Principal”: { “AWS”: “*”},
“Action”: [ “s3:GetObjectAcl”, “s3:ListBucket”],
“Resource”: [ “arn:aws:s3:::cloudacademy]
}]
A.
It will make the cloudacademy bucket as well as all its objects as public
B.
It will allow everyone to view the ACL of the bucket
C.
It will give an error as no object is defined as part of the policy while the action defines the rule about
the object
D.
It will make the cloudacademy bucket as public
Explanation:
A sysadmin can grant permission to the S3 objects or the buckets to any user or make objects public using the
bucket policy and user policy. Both use the JSON-based access policy language. Generally if the user is defining
the ACL on the bucket, the objects in the bucket do not inherit it and vice a versa. The bucket policy can be
defined at the bucket level which allows the objects as well as the bucket to be public with a single policy
applied to that bucket. In the sample policy the action says “S3:ListBucket” for effect Allow on Resource
arn:aws:s3:::cloudacademy. This will make the cloudacademy bucket public.
“Statement”: [{
“Sid”: “Stmt1388811069831”,
“Effect”: “Allow”,
“Principal”: { “AWS”: “*” },
“Action”: [ “s3:GetObjectAcl”, “s3:ListBucket”],
“Resource”: [ “arn:aws:s3:::cloudacademy]
}]
Both the answer and the explanation is incorrect; answer should be C. s3:GetObjectAcl requires an object as a resource but only a bucket is stated.
0
0
I agree with you.
0
0
Perfect Answer.
s3:GetObjectAcl will require “Resource”: [ “arn:aws:s3:::cloudacademy/*]
s3:ListBucket will require “Resource”: [ “arn:aws:s3:::cloudacademy]
0
0
Yes,I tested it, Answer should be C
0
0
Tested and got an error while saving the above S3 bucket policy:
” Action does not apply to any resource(s) in statement – Action “s3:GetObject” in Statement “Stmt123456788” “
0
0
c
0
0
C
0
0
Correct Answer is C
It will give an error as no object is defined as part of the policy while the action defines the rule about the object
0
0
change “Resource”: [ “arn:aws:s3:::cloudacademy] to “Resource”: [ “arn:aws:s3:::cloudacademy”] ,is the answer D ?
0
0
Still C, tested
0
0
c
0
0