This paper studies the exact controllability for stochastic transport equations by two controls: one is a boundary control imposed on the drift term and the other is an internal control imposed on the diffusion term. By means of the duality argument, this controllability problem can be reduced to an observability problem for backward stochastic transport equations, and the desired observability estimate is obtained by a new global Carleman estimate. Also, we present some results about the lack of exact controllability, which show that the action of two controls is necessary. To some extent, this indicates that the controllability problems for stochastic PDEs differ from their deterministic counterpart.