Exam AWS Certified SysOps Administrator - Associate topic 1 question 422 discussion

Explicit Deny Overrides Everything - If there is a statement with an Effect: Deny that explicitly denies an action, the action is denied outright, regardless of any "Allow" statements elsewhere in the policy.

Vote C. The last policy (3° part) deny all actions that are different by ec2:* e s3:GetObject, so the only permsisson are ec2:* e s3:GetObject, based of last policy. This last policy deny the first about allow rds:describe because like i said the only permission is ec2:* e s3:GetObject . So remain the 2° policy where we have ec2 :* with condition of us-east-1 Region. The only action allowed are the actions coming that from us-east-1 Region so the the answer is C.

Explicit deny overrides explicit allow.

C is the only possible answer for me NotAction explicitly matches everything except the specified list of actions. So there is EXPLICIT "Deny" for all actions EXCEPT "ec2:*", "s3:GetObject" , which would deny "rds:Describe*" because it is not in the list. According to AWS policy evaluation logic - "An explicit deny in any policy overrides any allows." - so Allow "rds:Describe*" would be overridden because of the Deny. https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html#policy-eval-denyallow https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_notaction.html

Agree with AC but D also seems fine - note that policy uses the NotAction element. This means it denies all actions EXCEPT listed in the NotAction array. In this case, all ec2:* actions and the s3:GetObject action are not denied, which means they are allowed.

A. Amazon RDS DescribeDBInstances action in the us-east-1 Region: Allowed. The policy grants describe access to all RDS resources (rds:Describe*). B. Amazon S3 PutObject operation in a bucket named testbucket: Not Allowed. There's no mention of S3 permissions in the policy, and there's a deny statement for s3:GetObject. PutObject likely isn't allowed either. C. Amazon EC2 DescribeInstances action in the us-east-1 Region: Allowed. The policy allows all EC2 actions (ec2:* ) in the us-east-1 region due to the condition. D. Amazon EC2 AttachNetworkInterface action in the eu-west-1 Region: Not Allowed. The policy allows EC2 actions only in the us-east-1 region (ec2:* with condition). Actions in any other region (eu-west-1 here) are not allowed due to the deny statement for ec2:* Therefore, the allowed actions for the IAM user are: A. Amazon RDS DescribeDBInstances action in the us-east-1 Region C. Amazon EC2 DescribeInstances action in the us-east-1 Region

A. Amazon RDS DescribeDBInstances action in the us-east-1 Region: Allowed. The policy grants describe access to all RDS resources (rds:Describe*). B. Amazon S3 PutObject operation in a bucket named testbucket: Not Allowed. There's no mention of S3 permissions in the policy, and there's a deny statement for s3:GetObject. PutObject likely isn't allowed either. C. Amazon EC2 DescribeInstances action in the us-east-1 Region: Allowed. The policy allows all EC2 actions (ec2:* ) in the us-east-1 region due to the condition. D. Amazon EC2 AttachNetworkInterface action in the eu-west-1 Region: Not Allowed. The policy allows EC2 actions only in the us-east-1 region (ec2:* with condition). Actions in any other region (eu-west-1 here) are not allowed due to the deny statement for ec2:* Therefore, the allowed actions for the IAM user are: A. Amazon RDS DescribeDBInstances action in the us-east-1 Region C. Amazon EC2 DescribeInstances action in the us-east-1 Region

A. Amazon RDS DescribeDBInstances action in the us-east-1 Region: Allowed. The policy grants describe access to all RDS resources (rds:Describe*). B. Amazon S3 PutObject operation in a bucket named testbucket: Not Allowed. There's no mention of S3 permissions in the policy, and there's a deny statement for s3:GetObject. PutObject likely isn't allowed either. C. Amazon EC2 DescribeInstances action in the us-east-1 Region: Allowed. The policy allows all EC2 actions (ec2:* ) in the us-east-1 region due to the condition. D. Amazon EC2 AttachNetworkInterface action in the eu-west-1 Region: Not Allowed. The policy allows EC2 actions only in the us-east-1 region (ec2:* with condition). Actions in any other region (eu-west-1 here) are not allowed due to the deny statement for ec2:* Therefore, the allowed actions for the IAM user are: A. Amazon RDS DescribeDBInstances action in the us-east-1 Region C. Amazon EC2 DescribeInstances action in the us-east-1 Region

I will vote A and C because both statements are right. However, the question allows only one choice. so I will go with C.