Which statement about controlling access with group policies is true?

In StorageGRID, group policies are attached to a specific tenant group and define which S3 resources members of that group are permitted or denied access to. NetApp explicitly states that a group policy applies to only one group and can apply to multiple buckets. This makes B the correct answer.

Group policies are configured through Tenant Manager or the Tenant Management API and use AWS-compatible JSON policy syntax. A single group policy can therefore contain multiple Resource entries referencing different buckets and objects. In contrast, a bucket policy is attached to one specific bucket and can grant or deny access to multiple users or groups.

Options A and C are incorrect because StorageGRID does not assign precedence among group, bucket, and session policies. NetApp states that there is no difference in priority among these policy types. Authorization is determined by evaluating the applicable policy statements, with an explicit Deny overriding an Allow; it is not based on one policy class automatically taking precedence over another.

Option D reverses the relationship: it describes the scope of a bucket policy rather than a group policy.

Reference topics: Tenant Manager → S3 Access Management → Group Policies → Bucket Policies → Session Policies → AWS Policy Language