A custom IAM policy for a reporting tool should follow least privilege for one S3 prefix. Which policy design best matches that goal?
Select an answer to reveal the explanation.
Short Explanation
Least privilege means the reporting tool gets a reading lamp, not the whole power grid — just GetObject on the one prefix it needs. Narrow the action and the resource, and you shrink what a mistake or breach can touch.
Full Explanation
A custom IAM policy for a reporting tool should allow only s3:GetObject on the specific bucket prefix the tool needs, matching least privilege. The reporting tool gets a reading lamp, not the whole power grid — narrow the action and the resource to shrink what a mistake or breach can touch. Allowing on all services for the entire account is maximum privilege. Allowing s3: on every bucket in every Region is far too broad for one prefix read. Denying all S3 access while relying on public ACLs invents a broken pattern that either blocks the tool or pushes data public. Distractors fail by overscoping allow, or by combining blanket deny with public ACL dependence. Exam caveat: least privilege includes both action verbs and resource ARNs; forgetting either side leaves gaps. Operational check: write a policy with s3:GetObject on arn:aws:s3:::bucket/prefix/*, attach via role or group, test the report job, confirm List/Put/Delete are absent unless required, and review CloudTrail for unexpected S3 calls from that principal. In practice, code-review the reporting tool policy for Action and Resource both being narrow, then validate with an integration test that off-prefix GetObject calls fail.