Question

A security engineer is troubleshooting access for an application running on an EC2 instance in Account A. The instance uses an IAM role that has NO identity-based policy statements granting S3 access. The application must read objects from an S3 bucket that also resides in Account A. The bucket has a bucket policy that explicitly allows the s3:GetObject action for the instance role's ARN as the principal. When the application calls GetObject, what is the result and why?

Accepted Answer

Access is allowed because for requests within the same account, an Allow in either the identity-based policy or the resource-based policy is sufficient to grant access.

Answer

Access is denied because within the same account, an IAM principal needs at least one Allow in either its identity-based policy or the resource-based policy — the bucket policy Allow alone is not sufficient.

Answer

Access is denied because same-account requests always require an Allow in BOTH the identity-based policy and the resource-based policy.

Answer

Access is denied because resource-based policies on S3 buckets cannot reference an IAM role ARN as a principal.