Restore S3 GetObject access by fixing ListBucket, KMS Decrypt, and the gateway-endpoint bucket policy

SCS-C02 By islever Editorial Last updated

Design and implement controls to protect credentials, secrets, and cryptographic key materials. Design and implement network security controls.

Short answer

ADE Missing s3:ListBucket, missing kms:Decrypt on the key policy, and a bucket policy not allowing the gateway endpoint block GetObject.

Question

A company has an application that needs to get objects from an Amazon S3 bucket. The application runs on Amazon EC2 instances. All the objects in the S3 bucket are encrypted with an AWS Key Management Service (AWS KMS) customer managed key. The resources in the VPC do not have access to the internet and use a gateway VPC endpoint to access Amazon S3. The company discovers that the application is unable to get objects from the S3 bucket. Which factors could cause this issue? (Choose three.)
  1. The IAM instance profile that is attached to the EC2 instances does not allow the s3:ListBucket action for the S3 bucket. Correct Answer
  2. The IAM instance profile that is attached to the EC2 instances does not allow the s3:ListParts action for the S3 bucket.
  3. The KMS key policy that encrypts the objects in the S3 bucket does not allow the kms:ListKeys action to the EC2 instance profile ARN.
  4. The KMS key policy that encrypts the objects in the S3 bucket does not allow the kms:Decrypt action to the EC2 instance profile ARN. Correct Answer
  5. The S3 bucket policy does not allow access from the gateway VPC endpoint. Correct Answer

Key Takeaways

Reading a KMS-encrypted object through a gateway endpoint needs three permissions aligned: S3 read/list permission on the instance profile, kms:Decrypt on the CMK key policy for that principal, and a bucket policy that permits the gateway endpoint. ListParts is for multipart uploads and ListKeys is for key enumeration—neither affects GetObject. A, D, E are the failure factors.

An EC2 app reaches S3 only through a gateway VPC endpoint, and objects are KMS-CMK encrypted. Three things can block GetObject: the instance profile lacks s3:ListBucket (needed to enumerate/resolve the objects it fetches), the KMS key policy does not grant kms:Decrypt to the instance profile (required to decrypt the object on read), and the S3 bucket policy does not allow access from the gateway VPC endpoint (so even the endpoint path is denied). s3:ListParts (B) and kms:ListKeys (C) are unrelated to reading objects.

Common mistake: Picking C (missing kms:ListKeys)—ListKeys only lists key IDs and is not required to decrypt an object. Picking B (missing s3:ListParts)—ListParts is for multipart upload completion, irrelevant to reading. The real blockers are ListBucket scope, kms:Decrypt, and the endpoint bucket policy.

Expert Analysis

Why the Answer Is Correct

A (missing s3:ListBucket on the instance profile) blocks the app from resolving/listing the objects it needs. D (missing kms:Decrypt on the CMK key policy for the instance profile) blocks decryption of the encrypted object on read. E (bucket policy not allowing the gateway VPC endpoint) denies even the endpoint path to S3. All three independently prevent GetObject success. These are the factors that could cause the failure.

Why the Other Options Are Wrong

B (missing s3:ListParts) applies to multipart upload completion, not object reads, so it does not block GetObject. C (missing kms:ListKeys) only affects enumerating key IDs, not decrypting a specific object—kms:Decrypt is what is needed. A, D, E are the correct set of factors.

Community Comment Notes

Community voted A,D,E (100). Commenters called A and E obvious and noted D (KMS Decrypt on the key policy for the instance profile) as the less-obvious blocker. B and C were excluded as unrelated to reading encrypted objects.

Official Reference

These links open the official vendor documentation in a new tab.

Community Votes

ADE
100%

100% of anonymous learners picked answer ADE. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. Zek 👍 4
    ADE -Agree See similar question a public discussion thread on this question
  2. TareDHakim 👍 1
    A&E are obvious ones, For D. There's a similar scenario described here,
  3. navid1365 👍 2
    A, D, E are correct
  4. Certified101 👍 2
    ADE look right
  5. FunkyFresco 👍 1
    ADE match with the question.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Preserve EC2 forensic evidence by isolating first, then capturing memory before stopping the instance

S-grade

Grant the report Lambda Security Hub read-only access because findings are already in Security Hub

S-grade

Deny inbound MySQL 3306 and allow outbound TLS 443 with ephemeral return in a custom NACL

S-grade

Prepare a PHI/public-bucket audit with Macie, Audit Manager, and Security Hub FSBP

S-grade

← Back to SCS-C02 Study Guide