Reviewed by Aditya Kumar · Last reviewed 2026-03-24
Architectural logic: Bucket policy with Condition on aws:PrincipalArn (EC2 role) or aws:SourceInstance. Example: Condition StringEquals aws:PrincipalArn arn:aws:iam::123456789012:role/MyEC2Role. EC2 must use that role. Why: Restrict access to specific compute; defense in...
Architectural logic: Bucket policy with Condition on aws:PrincipalArn (EC2 role) or aws:SourceInstance. Example: Condition StringEquals aws:PrincipalArn arn:aws:iam::123456789012:role/MyEC2Role. EC2 must use that role. Why: Restrict access to specific compute; defense in depth. Best practice: Prefer IAM role policies; bucket policy for cross-account; least privilege.
Red Flag: Allowing * principal without condition. Pro-Move: 'We restrict by role ARN; only ETL role can write to raw bucket—audit shows single principal.'
According to DataEngPrep.tech, this is one of the most frequently asked Cloud/Tools interview questions, reported at 1 company. DataEngPrep.tech maintains an editor-reviewed database of 1,863 data engineering interview questions across 7 categories.