DEA-C01 Data Ingestion and Transformation Practice Question
Exhibit
Refer to the exhibit. Resource: "arn:aws:logs:us-east-1:123456789012:log-group:my-log-group:*"
An IAM policy includes the above resource ARN for CloudWatch Logs. A data engineer needs to allow a Lambda function to create log streams and put logs to the log group 'my-log-group'. However, the Lambda function is failing with access denied. What is the issue?
⚠ Common exam trap
Watch out — candidates often assume granting access to the log group ARN implicitly covers log streams, but AWS IAM requires explicit resource-level permissions for each subresource in the ARN hierarchy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ARN does not include the log-stream portion.
The ARN provided in the policy is for the log group itself (arn:aws:logs:region:account-id:log-group:my-log-group), but CloudWatch Logs requires separate permissions for the log-stream subresource. To allow a Lambda function to create log streams and put logs, the ARN must include the log-stream portion, typically with a wildcard like arn:aws:logs:region:account-id:log-group:my-log-group:log-stream:*. Without this, the IAM policy does not grant access to the log-stream actions (CreateLogStream, PutLogEvents), causing an access denied error even if the log group ARN is correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The region in the ARN does not match the Lambda function's region.
Why it's wrong here
The ARN's region must match the log group's region, and IAM evaluates it in the function's region; a mismatch would deny access, but the stem gives no evidence of one. It is tempting because region errors are a common ARN fault, yet the real issue is the action or resource scope.
- ✗
The Lambda function does not have an execution role.
Why it's wrong here
A Lambda function always assumes an execution role; without one it cannot run at all, so this cannot explain a running function receiving access denied. It is tempting because missing roles cause permission failures, but the concrete gap is the policy's action and resource statements.
- ✓
The ARN does not include the log-stream portion.
Why this is correct
CloudWatch Logs actions such as CreateLogStream and PutLogEvents require the ARN to include the log-stream wildcard suffix (log-group:my-log-group:log-stream:*). The policy's ARN stops at the log-group level, so the Lambda function lacks permission for stream-level operations.
- ✗
The ARN is incorrectly formatted because of the wildcard.
Why it's wrong here
CloudWatch Logs ARNs legitimately end with a wildcard to cover log streams within the group, so the wildcard is valid and not the cause. This distractor is tempting because malformed ARNs do cause access denied, but the actual failure lies in the missing log-stream-level permissions.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 1,321 original DEA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.