To meet regulatory requirements, a security engineer needs to implement an IAM policy that restricts the use of AWS services to the us-east-1 Region. What policy should the engineer implement? A. B…

Question

Options

• A{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "", "Resource": "", "Condition": { "StringEquals": { "aws:RequestedRegion": "us-east-1" } } } ] }
• B{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "", "Resource": "", "Condition": { "StringEquals": { "ec2:Region": "us-east-1" } } } ] }
• C{ "Version": "2012-10-17", "Statement": [ { "Effect": "Deny", "Action": "", "Resource": "", "Condition": { "StringNotEquals": { "aws:RequestedRegion": "us-east-1" } } } ] }
• D{ "Version": "2012-10-17", "Statement": [ { "Effect": "Deny", "NotAction": "", "Resource": "", "Condition": { "StringEquals": { "aws:RequestedRegion": "us-east-1" } } } ] }

• A
  10% (4)
• B
  7% (3)
• C
  56% (23)
• D
  27% (11)

Explanation

Option C is correct because it uses a Deny effect with StringNotEquals on aws:RequestedRegion, which explicitly denies all actions on all resources when the requested region is anything other than us-east-1. This is the proper way to restrict AWS service usage to a specific region, as Deny always overrides Allow in IAM policy evaluation, making it an effective guardrail. The aws:RequestedRegion global condition key is the correct and universal key for region-based restrictions across all AWS services.

No community discussion yet for this question.