AWS Certified SysOps Administrator Practice Exam

Why might the root user of an AWS account unable to access an S3 bucket owned by that account?

1. The bucket is configured to deny access to the root user

2. The bucket's policies don’t include the root user

3. The user is not signed in to the root account

4. Permissions must be granted via IAM only

The correct answer is: The bucket's policies don’t include the root user

The root user of an AWS account can encounter issues accessing an S3 bucket due to the way AWS handles permissions and access controls. In this context, if the bucket's policies do not explicitly include the root user, that can prevent the root user from accessing the S3 bucket. While the root user generally has full permissions by default, specific bucket policies may override this default behavior, leading to an inability to access the bucket. AWS Identity and Access Management (IAM) policies or S3 bucket policies can define which actions are permitted or denied for specific users or groups. If the policies do not grant permissions for the root user or include specific conditions that restrict access, it results in access being denied despite the root user’s overall high authority level within the AWS account. This highlights an important aspect of AWS's approach to security and permissions, which allows for granular control over access regardless of the account level. It emphasizes the importance of explicitly defining policies to suit the intended access control, ensuring that even the root user is subject to the rules defined at the bucket level.