SCS-C02 Question 315
Single answerAn organization wants to grant an IAM user the ability to start and stop EC2 instances, but only in a specific AWS region. They create the following policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:StartInstances",
"ec2:StopInstances"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:RequestedRegion": "us-east-1"
}
}
}
]
}
However, after attaching the policy, the user reports they cannot start or stop the instances. What is the MOST likely reason for this issue?
- A
The policy's
Resourcefield is set to "*", which is overly permissive and causes the policy to be ignored. - B
The IAM user does not have explicit permissions to describe EC2 instances, which is required for starting or stopping them.
- C
The
aws:RequestedRegioncondition key is invalid, causing the policy to fail validation. - D
The IAM user also needs an explicit
ec2:DescribeInstancespermission in the same policy for it to work.
Show answer and explanation
Correct answer: B
Explanation
When starting or stopping EC2 instances, AWS requires the ec2:DescribeInstances permission to fetch instance details. This permission is not included in the policy presented, which results in the user being unable to start or stop instances even though the StartInstances and StopInstances actions are allowed. Adding the ec2:DescribeInstances permission would resolve this issue.
- A. Incorrect.
The
Resourcefield being set to "*" is valid in this context, as it means the policy applies to all EC2 instances. This is not the cause of the issue. - B. Correct.
The IAM user does not have explicit permissions to describe EC2 instances. The
ec2:DescribeInstancespermission is required because AWS needs to query the instance details during the start and stop operations. - C. Incorrect.
The
aws:RequestedRegioncondition key is valid and used correctly in this policy to restrict the actions to theus-east-1region. This is not the cause of the issue. - D. Incorrect.
While adding
ec2:DescribeInstancespermission is necessary, it does not need to be in the same policy. Permissions can be granted using multiple policies attached to the user or role.