DBS-C01 Deployment and Migration Practice Question

Exhibit

Refer to the exhibit.
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["dms:CreateReplicationTask", "dms:StartReplicationTask"],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "us-east-1"
        }
      }
    }
  ]
}

A company is migrating a database using AWS DMS. The IAM policy shown is attached to the DMS replication instance role. When the DMS replication task is created in the us-west-2 region, it fails. What is the most likely cause?

⚠ Common exam trap

The trap here is that candidates often overlook the `Condition` block with `aws:RequestedRegion` and focus only on the Action and Resource fields, assuming a missing action or resource ARN is the cause, when the real issue is a regional restriction enforced by the condition key.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The IAM policy restricts the region to us-east-1, but the task is created in us-west-2.

The IAM policy explicitly restricts the region to us-east-1 using the `aws:RequestedRegion` condition key. When the DMS replication task is created in us-west-2, the policy denies the `dms:CreateReplicationTask` action because the region condition fails, causing the task creation to fail. DMS replication tasks require the IAM role to have permissions in the same region where the task is being created.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The IAM policy does not allow the 'dms:CreateReplicationTask' action.
Why it's wrong here
The policy explicitly allows that action.
✗
The IAM policy does not specify the VPC where the replication instance is deployed.
Why it's wrong here
VPC is not required in the policy for this action.
✗
The IAM policy does not specify the resource ARN for the replication instance.
Why it's wrong here
The resource is set to '*', which includes all resources.
✓
The IAM policy restricts the region to us-east-1, but the task is created in us-west-2.
Why this is correct
The condition 'aws:RequestedRegion' restricts to us-east-1 only.

Go deeper

DBS-C01 Deployment and Migration Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question