Exam AWS Certified Developer Associate topic 1 question 307 discussion

So A and C have s3:DeleteObject as allowed method and those are to be excluded. The B has the method s3:CreateBucket and s3:GetBucketLocation that allow the application to create a bucket and to get location but we can't add or download elements from the bucket. So, also the B is incorrect. The correct answer iisssssss................. D! We do need s3:GetObject to retrive elements from the bucket and s3:PutObject to upload the object on the cloud

To ensure that users can create but not remove files from the Amazon S3 bucket, the developer should apply the following IAM permissions to the users: s3:PutObject: This permission allows users to add objects to the bucket. s3:GetObject: This permission allows users to download the objects in the bucket. The developer should not grant the s3:DeleteObject permission, which would allow users to remove objects from the bucket. By not granting this permission, the company can maintain copies of all files uploaded by users for compliance purposes, while still allowing users to access the data through the application.

Choosing D

D is correct

Ans: D To accomplish: "can create but not remove files" -- Need: "Put Object" -- Don't need: "Delete Object" https://docs.aws.amazon.com/cli/latest/reference/s3api/put-object.html