Uploads to a municipal evidence bucket should succeed only when the object key prefix matches the caller’s department tag. Which IAM technique enforces that attribute-based rule?
Select an answer to reveal the explanation.
Short Explanation
Think of the evidence room stamping each badge with a department code before anyone shelves a box. IAM conditions bind that PrincipalTag to the object prefix so uploads cannot wander into another department’s aisle. Trusting the client alone is wishful thinking.
Full Explanation
IAM condition keys support attribute-based constraints so an application principal can PutObject only under prefixes that match attributes such as aws:PrincipalTag. That encodes the department-prefix rule in the authorization layer. Unconditional "*" PutObject and client-side honor systems do not enforce the constraint. Versioning settings are unrelated to authorizing the correct prefix.