Exams / DVA-C02 / IAM roles, policies and STS / Question 3
DVA-C02 practice question: IAM roles, policies and STS (3 of 3)
Security A free question from our original DVA-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
A developer's script calls an Amazon EC2 API and receives an UnauthorizedOperation error that contains an encoded authorization failure message. The developer wants to see which action, resource and condition values caused the denial. What should the developer do?
Choose one answer.
- AA. Paste the encoded message into the IAM policy simulator as a policy document.
- BB. Base64-decode the message locally, because it is plain JSON encoded for transport.
- CC. Call the AWS STS DecodeAuthorizationMessage API with a principal allowed to do so.
- DD. Search CloudTrail event history for the message, which stores a decoded copy.
Show the answer and explanation
Answer: C
- A. Wrong: The policy simulator tests policies. It does not decode authorization failure messages.
- B. Wrong: The message is encoded because it can contain privileged details. It must be decoded through AWS STS.
- C. Right: Correct. The decoded message shows whether there was an explicit deny, the principal, action, resource and condition values.
- D. Wrong: CloudTrail records the failed call and its error code, but it does not decode the encoded message for you.
Explanation
Some AWS APIs return an encoded message with an authorization failure, because the details may be sensitive. The STS DecodeAuthorizationMessage action decodes it, and the caller needs the sts:DecodeAuthorizationMessage permission. The result shows whether the request failed on an explicit deny or a missing allow, which speeds up fixing the policy.
Study
Keep practising
Answer questions with a score at the end, or practise just this topic with the explanation after each one. No sign-up needed.