SOA-C03 practice question: Auditing and troubleshooting access (1 of 2)
Security and Compliance A free question from our original SOA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
At a ski resort, developers use an IAM role named dev-ops whose identity-based policy allows ec2:* on all resources.
The role also has a permissions boundary that allows s3:*, logs:* and cloudwatch:*. The account is in an organizational unit whose SCPs allow all actions.
When a developer calls ec2:RunInstances, the request fails with an AccessDenied error.
What is the cause, and how should it be fixed?
Choose one answer.
AA. The SCP denies EC2 implicitly because it allows all actions, so the SCP must list ec2:RunInstances explicitly.
BB. The identity-based policy needs a resource-level ARN for each subnet and AMI, because ec2:* on all resources is not supported.
CC. The role's trust policy does not allow the developers to call EC2, so the trust policy must add ec2.amazonaws.com as a principal.
DD. The permissions boundary does not allow EC2 actions, so the effective permissions exclude them; the boundary must be updated to allow the needed EC2 actions.
C. Wrong: The trust policy controls who can assume the role, and the developers already assume it successfully. Adding the EC2 service as a principal would not grant API permissions. Learn more: IAM roles (opens in a new tab)
When a request is denied despite an Allow, check every policy type in the evaluation chain: SCPs, permissions boundaries, identity policies and session policies. A permissions boundary caps the role's permissions, so an action must be allowed by both the boundary and the identity policy. The IAM policy simulator can show which policy blocks the call.
Want more on Auditing and troubleshooting access? The 5 full-length practice sets have 7 more Auditing and troubleshooting access questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →