A company has an AWS CloudFormation template that creates an Amazon S3 bucket. A user authenticates to the corporate AWS account with their Active Directory credentials and attempts to deploy the…

Question

Options

• AThe user's IAM policy does not allow the cloudformation:CreateStack action.
• BThe user's IAM policy does not allow the cloudformation:CreateStackSet action.
• CThe user's IAM policy does not allow the s3:CreateBucket action.
• DThe user's IAM policy explicitly denies the s3:ListBucket action.
• EThe user's IAM policy explicitly denies the s3:PutObject action.

• A
  76% (31)
• B
  7% (3)
• D
  5% (2)
• E
  12% (5)

Explanation

Deploying a CloudFormation stack requires two layers of IAM permissions: the user needs cloudformation:CreateStack to initiate the stack (A), and because CloudFormation acts on the user's behalf to create the S3 bucket, the user also needs s3:CreateBucket (C) - without either permission, the operation fails.

Why the distractors are wrong:

• B - cloudformation:CreateStackSet is for StackSets (multi-account/region deployments), not a single stack deployment.
• D - s3:ListBucket is a read operation for listing objects; denying it doesn't prevent bucket creation.
• E - s3:PutObject allows uploading objects into an existing bucket; denying it has no effect on bucket creation itself.

Memory tip: Think of CloudFormation stack creation as a two-door problem - you need a key for the CloudFormation door (cloudformation:CreateStack) AND a key for the resource door (the AWS service action that actually creates the resource, e.g., s3:CreateBucket). If either key is missing, the stack fails.

No community discussion yet for this question.