I Do not understand the answer to the following question

[wail-el-edghiri]

Hello all,

I’m new to this forum and would like to get help on the following question from test 1 in the aws associate developer certification set tests

A company has created a private S3 bucket named tdojo. The Developer IAM role must be granted read access to all objects within this bucket. However, objects stored under the qa folder should be restricted to the QA IAM role only.

Which S3 bucket policy will effectively implement the principle of least privilege access while satisfying the given requirements?

I don’t understand why the answer should be granting the developer team access to all the objects in the bucket while in the question it’s stated that the qa object should only be accessible to QA role. Thanks in advance for your help.

• This discussion was modified 1 year, 4 months ago by  wail-el-edghiri.

[Carlo-TutorialsDojo]

Hello wail-el-edghiri,

Thanks for your feedback.

The scenario specifically states two conditions. First, the Developer IAM role needs to have read access to all objects in the bucket. This is just one part of the equation. The second piece is that the QA role should only have access to the ‘qa’ folder. The correct option must address both of these requirements.

Let me know if this answers your question.

Regards,

Carlo @ Tutorials Dojo

[fxwinter]

Hi – i stumbled over this same question for the same reason.

>The second piece is that the QA role should only have access to the ‘qa’ folder.

This is not what it states. It states that objects in the qa folder should be restricted to the QA role exclusively.

The question is clearly ambiguous (if not flat out wrong), as it specifies that “objects stored under the qa folder should be restricted to the QA IAM role only”, i.e. anything inside this folder is *only* accessible for the QA role and noone else. Even though it also says that the developer role should be granted read access to all objects, when the next sentence starts with “However[…]” it reads like what follows is an exception to that.

I would suggest simply rephrasing the third sentence to “The QA IAM role however, should be restricted to objects stored under the qa folder only.”

[JR-TutorialsDojo]

Hello fxwinter,

Thank you for bringing this to our attention.

We appreciate your feedback and understand the confusion caused by the question’s wording. We will make the necessary updates to eliminate any ambiguity, and these changes should be reflected on the portal soon.

If you have any additional suggestions or feedback, please feel free to share them with us. We are committed to improving our practice tests based on user input.

Best regards,
JR @ Tutorials Dojo