A company uses Amazon EC2 instances to host its internal systems. As part of a deployment operation, an administrator tries to use the AWS CLI to terminate an EC2 instance. However, the administrator

Question

Exhibit

Options

• AThe EC2 instance has a resource-based policy with a Deny statement.
• BThe principal has not been specified in the policy statement.
• CThe "Action" field does not grant the actions that are required to terminate the EC2 instance.
• DThe request to terminate the EC2 instance does not originate from the CIDR blocks 192.0.2.0/24

• A
  3% (1)
• B
  10% (3)
• C
  3% (1)
• D
  83% (25)

Explanation

The IAM policy includes two statements: Allow ec2:TerminateInstances on all resources Deny ec2:TerminateInstances if the request does NOT come from: AWS IAM policy evaluation rules state: Explicit Deny always overrides Allow. A request must meet all applicable conditions in the policy to be granted. aws: SourceIp condition applies when IAM actions are invoked via the public AWS APIs. In this scenario, the administrator is not originating the request from one of the allowed CIDR blocks, so the Deny condition is triggered, overriding the Allow statement. Therefore, the operation is blocked with: 403 AccessDenied: explicit deny This matches the behavior described in the AWS IAM Policy Evaluation Logic used in the Security Pillar of the Well-Architected Framework: Explicit Deny > Allow > Default Deny IP-based Conditions restrict API calls originating outside approved network ranges Options A/B/C do not accurately reflect this explicit Deny condition behavior.

No community discussion yet for this question.