Your team uses an S3 bucket called artifacts-bucket to store important files generated from pipelines. An intern accidentally removed the bucket policy and added the following bucket policy:

Answer options:

A.Use an IAM user of the bucket’s AWS account to execute the AWS CLI “aws s3api put-bucket-policy” to restore the bucket policy to the previous one.
B.Sign in to the Amazon S3 console as the AWS account root user, delete the incorrect bucket policy and add the previous bucket policy that worked properly.
C.Any IAM user of the AWS account can use AWS console to delete the S3 bucket policy, even if the policy explicitly denies the user the ability to perform this action.
D.This bucket policy cannot be restored by any IAM user of the account. Need to contact AWS support to recover the S3 bucket policy.

Correct Answer: B
Option A is incorrect because this bucket policy explicitly denies any S3 actions if the user is not UserID_A. If the user is not root or UserID_A, it cannot modify the S3 bucket policy through AWS CLI.
Option B is CORRECT because the root user can always modify the S3 bucket policy even if the policy denies the root user to perform the action. This is a security precaution.
Option C is incorrect because with this bucket policy, only root or UserID_A can delete the S3 bucket policy through AWS console or CLI.
Option D is incorrect because the root user can restore the S3 bucket policy. There is no need to engage AWS support. Normally, AWS support has read-only access and does not modify customer resources directly.
Reference:
https://aws.amazon.com/premiumsupport/knowledge-center/s3-accidentally-denied-access/,
https://docs.aws.amazon.com/cli/latest/reference/s3api/put-bucket-policy.html