A security policy allows instances in the Production and Development accounts to write application logs to an Amazon S3 bucket belonging to the Security team’s account. Only the Security team should be allowed to delete logs from the S3 bucket.
Using the “myAppRole” EC2 role, the production and development teams report that the application servers are not able to write to the S3 bucket.
Which changes need to be made to the policy to allow the application logs to be written to the S3 bucket?
Production Account: 111111111111
Dev Account: 222222222222
Security Account: 555555555555


A. Update the Action for the Allow policy from “s3:*” to “s3:PutObject”
B. Change the order of the statements in the bucket policy, moving the Deny policy above the Allow policy.
C. Update the Action for the Deny policy from “s3:*” to “s3: Delete*”.
D. Remove the bucket policy, because the default security behavior will not allow objects to be deleted by non bucket owners.