AWS Solutions Architect Associate (SAA-C03) — Practice Exam

An IAM user at Larkspur Media belongs to a group with this policy: {"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Action": "s3:*", "Resource": "arn:aws:s3:::larkspur-reports/*"}]}. The user also has this inline policy: {"Version": "2012-10-17", "Statement": [{"Effect": "Deny", "Action": "s3:DeleteObject", "Resource": "arn:aws:s3:::larkspur-reports/*"}]}. No other policies apply. What happens when the user tries to delete an object in the larkspur-reports bucket?

• A.The request is allowed because the group policy grants s3:*
• B.The request is denied because an explicit Deny overrides any Allow
• C.The request is allowed because group policies take precedence over inline policies
• D.The request is denied only if the bucket has versioning enabled