ExamPark
Course menuDVA-C03

Exams / DVA-C03 / IAM roles, policies and STS / Question 3

DVA-C03 practice question: IAM roles, policies and STS (3 of 3)

Security A free question from our original DVA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

A developer whose role has only Amazon EC2 permissions runs a deployment script that calls ec2:RunInstances.

The call fails with UnauthorizedOperation and a long encoded authorization failure message. To fix the policy, the developer needs the decoded details, including the action, the resource and the condition values that were evaluated.

What should be done?

Choose one answer.

  1. A. Ask an administrator to allow sts:DecodeAuthorizationMessage for the developer's role, then call the AWS STS DecodeAuthorizationMessage API.
  2. B. Run the message through a Base64 decoder, because it is plain JSON that has only been Base64-encoded for transport.
  3. C. Paste the message into the IAM policy simulator, which accepts encoded failure messages and lists the matching statements.
  4. D. Find the failed call in CloudTrail event history and read the decoded message that CloudTrail stores with it.
Show the answer and explanation

Answer: A

  • A. Right: Correct. The message is encoded because it can contain details the caller should not see by default, so decoding is a separate permission. Once allowed, STS returns the decoded detail, including the principal, action, resource and condition values. Learn more: DecodeAuthorizationMessage (opens in a new tab)
  • B. Wrong: The message is not simply Base64-encoded JSON. Only STS can decode it, and only for callers that have been given permission to do so.
  • C. Wrong: The policy simulator tests a policy against actions that you choose; it does not accept an encoded failure message. It would not show the condition values from the failed request either.
  • D. Wrong: CloudTrail records API activity and can show that the call failed, but the way to decode this message is the dedicated STS API. Searching event history is not a replacement for it. Learn more: DecodeAuthorizationMessage (opens in a new tab)

Explanation

Encoded authorization failure messages are decoded with the STS DecodeAuthorizationMessage API, and the caller needs sts:DecodeAuthorizationMessage. The decoded result shows whether an explicit deny or a missing allow caused the failure, with the action, resource and condition values. Base64 tools, the policy simulator and CloudTrail do not decode the message.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free DVA-C03 practice examPractice IAM roles, policies and STSAll IAM roles, policies and STS questions

Want more on IAM roles, policies and STS? The 5 full-length practice sets have 15 more IAM roles, policies and STS questions, 390 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets