A company needs to ensure that an IAM group that contains database administrators can perform operations only within Amazon RDS. The company must ensure that the members of the IAM group cannot access

Question

Options

• ACreate an IAM policy that includes a statement that has the Effect "Allow" and the Action "rds:".
• BCreate an IAM policy that includes two statements. Configure the first statement to have the
• CCreate an IAM policy that includes a statement that has the Effect "Deny" and the NotAction
• DCreate an IAM policy with a statement that includes the Effect "Allow" and the Action "rds:".

• A
  5% (2)
• B
  24% (9)
• C
  59% (22)
• D
  11% (4)

Explanation

To enforce that IAM users can only access Amazon RDS and no other AWS services, the recommended approach is to use a Deny statement with NotAction. This ensures that all actions are denied except RDS actions. Options A and B do not fully achieve the restriction: A only allows RDS but does not explicitly deny access to other services if another policy grants access; B's explicit Deny for "*" would override all other permissions, including the intended RDS Allow, which would result in no access at all. Option D with permissions boundaries still allows other attached policies to grant access outside RDS. Therefore, C is the correct approach to enforce RDS-only

No community discussion yet for this question.