Exam AWS Certified Security - Specialty SCS-C02 topic 1 question 171 discussion

B is correct https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#sts-session-principals

Answer provided by Claude 3.5 Sonnet: The correct policy to meet the company's requirements is option B. Here's why: It correctly identifies Bob as a federated user: "arn:aws:sts::account-id:federated-user/Bob" It sets the "Effect" to "Deny", which will prevent Bob from accessing the bucket. It specifies the correct S3 bucket: "arn:aws:s3:::DOC-EXAMPLE-BUCKET" The Action is set to "s3:*", which means it will deny all S3 actions for this specific bucket. This policy will only affect Bob's S3 permissions for the specified bucket, meeting the requirement that other permissions Bob has must remain intact. It's a bucket policy, so it will only apply to this specific S3 bucket and won't affect Bob's permissions elsewhere. Options A, C, and D are incorrect because: A: This policy allows access instead of denying it. C: This policy uses the wrong ARN format for a federated user. D: This policy targets an assumed role session, not a federated user directly.