Which of the following is a possible reason that the IAM user cannot access the objects in the S3 bucket?

By:
In: SCS-C01
Tagged:
With: 1 Comment
An IAM user receives an Access Denied message when the user attempts to access objects in an Amazon S3 bucket.The user and the S3 bucket are in the same AWS account.The S3 bucket is configured to use server-side encryption with AWS KMS keys (SSE-KMS) to encrypt all of its objects at rest by using a customer managed key from the same AWS account.The S3 bucket has no bucket policy defined.The IAM user has been granted permissions through an IAM policy that allows the kms:Decrypt permission to the customer managed key.The IAM policy also allows the s3:List* and s3:Get* permissions for the S3 bucket and its objects.

Which of the following is a possible reason that the IAM user cannot access the objects in the S3 bucket?

The IAM policy needs to allow the kms:DescribeKey permission.

The S3 bucket has been changed to use the AWS managed key to encrypt objects at rest.

An S3 bucket policy needs to be added to allow the IAM user to access the objects.

The KMS key policy has been edited to remove the ability for the AWS account to have full access to the key.

Explanations:

Thekms:DescribeKeypermission is not required for decrypting objects in S3. Thekms:Decryptpermission is sufficient.

The issue is related to KMS permissions, not the encryption method. The KMS key is a customer-managed key in the same account.

The S3 bucket has no bucket policy, but the issue is related to KMS permissions, not S3 bucket policies.

If the KMS key policy has been edited to remove full access for the AWS account, it would prevent the IAM user from decrypting objects.

2025-10-02

1 Comment

  1. Diane
    Author

    From my perspective, the answer is:
    The KMS key policy has been edited to remove the ability for the AWS account to have full access to the key.

Leave a Reply to Diane Cancel reply

Your email address will not be published. Required fields are marked *

five × one =