AWS Certified CloudOps Engineer Associate SOA-C03 Practice Question

The policy must compare the 'Team' tag attached to the IAM principal with the 'Team' tag attached to the S3 object on which the 'DeleteObject' request is made. The global condition key aws:ResourceTag/tag-key refers to a tag that exists on the target resource (the S3 object), and the policy variable ${aws:PrincipalTag/Team} expands to the value of the caller's 'Team' tag at runtime. Using the StringEquals operator enforces an exact match; if the tags differ or are absent, the request is denied.

Using s3:ExistingObjectTag is incorrect as this condition key is typically used for actions like s3:ReplicateObject, not for general access control on s3:DeleteObject. Using StringEqualsIfExists would allow the operation when the object lacks the 'Team' tag, creating a security gap. The final option incorrectly reverses the operands and attempts to use a condition key as a policy variable, which is syntactically invalid.