A company is managing multiple AWS accounts in AWS Organizations. The company is A company has attached the following policy to an IAM user: Which of the following actions are allowed for the IAM…

The correct answer is C. Amazon EC2 DescribeInstances action in the us-east-1 Region. The first statement explicitly allows any RDS action that begins with rds:Describe. The second statement explicitly allows any EC2 action, but only in the us-east-1 Region. The third statement is an explicit Deny for all actions except those that match either ec2: or…

Submitted by satoshi_tk· Mar 30, 2026Security and Compliance

Question

A company is managing multiple AWS accounts in AWS Organizations. The company is A company has attached the following policy to an IAM user:

Which of the following actions are allowed for the IAM user?

Options

AAmazon RDS DescribeDBInstances action in the us-east-1 Region
BAmazon S3 PutObject operation in a bucket named testbucket
CAmazon EC2 DescribeInstances action in the us-east-1 Region
DAmazon EC2 AttachNetworkInterface action in the eu-west-1 Region

How the community answered

(40 responses)

A
5% (2)
B
5% (2)
C
78% (31)
D
13% (5)

Explanation

The first statement explicitly allows any RDS action that begins with rds:Describe*. The second statement explicitly allows any EC2 action, but only in the us-east-1 Region. The third statement is an explicit Deny for all actions except those that match either ec2:* or s3:GetObject. Because explicit Deny overrides any Allow, only actions that are either an EC2 action (or s3:GetObject) will be permitted.

Topics

#IAM policy evaluation#condition keys#EC2 permissions#policy analysis

Community Discussion

No community discussion yet for this question.

Full SOA-C02 Practice