A company has attached the following policy to an IAM user: Which of the following actions are allowed for the IAM user?

Question

Options

• AAmazon RDS DescribeDBInstances action in the us-east-1 Region
• BAmazon S3 Putobject operation in a bucket named testbucket
• CAmazon EC2 Describe Instances action in the us-east-1 Region
• DAmazon EC2 AttachNetworkinterf ace action in the eu-west-1 Region

• A
  4% (1)
• B
  15% (4)
• C
  74% (20)
• D
  7% (2)

Explanation

Option C is correct because the attached policy typically allows ec2:Describe* actions scoped to the us-east-1 region - DescribeInstances matches the Describe* wildcard and satisfies the region condition, making it the only fully permitted action.

Why the distractors are wrong:

• A (RDS DescribeDBInstances): The policy grants EC2 permissions, not RDS. Different AWS services require separate, explicit service namespaces (e.g., rds:* vs. ec2:*).
• B (S3 PutObject): S3 is also not covered by the policy - no s3:* permissions are granted, and PutObject is a write action, not a describe/read action.
• D (EC2 AttachNetworkInterface in eu-west-1): Two problems here - AttachNetworkInterface is not a Describe* action and therefore not permitted, and even if it were, the region condition restricts all actions to us-east-1 only.

Memory tip: Think of IAM policy evaluation with three filters: Service (right namespace?), Action (matches the pattern?), Condition (region/resource satisfied?). A request must pass all three - failing any one = denied. For wildcard actions like ec2:Describe*, always verify the action name starts with the allowed prefix.

No community discussion yet for this question.