DBS-C01 Management and Operations Practice Question

Exhibit

Refer to the exhibit.

Exhibit: IAM policy snippet
```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "rds:CreateDBInstance",
        "rds:DeleteDBInstance",
        "rds:ModifyDBInstance"
      ],
      "Resource": "arn:aws:rds:us-east-1:123456789012:db:prod-*"
    }
  ]
}
```

A database administrator is creating an IAM policy to allow a DevOps engineer to manage production RDS instances. The policy above is attached to the engineer's IAM role. The engineer reports that they cannot create a new DB instance with the identifier 'prod-analytics'. What is the most likely reason?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The engineer does not have permissions to pass an IAM role to the DB instance if one is specified.

The most likely reason is that when creating the DB instance, the engineer specified an IAM role to be associated with the instance (e.g., for backup or monitoring). The attached policy does not include an 'iam:PassRole' action, which is required to pass the role to RDS. Without it, the CreateDBInstance call fails due to insufficient permissions to pass the specified role.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The policy does not allow the 'rds:CreateDBInstance' action on the required resource because the resource ARN pattern is incorrect.
Why it's wrong here
The resource ARN pattern 'prod-*' matches 'prod-analytics'.
✗
The policy does not include the 'rds:CreateDBSecurityGroup' action.
Why it's wrong here
RDS uses security groups, not DBSecurityGroup (deprecated).
✓
The engineer does not have permissions to pass an IAM role to the DB instance if one is specified.
Why this is correct
When creating a DB instance with an IAM role, the 'iam:PassRole' permission is required. This is a common missing permission.
✗
The policy does not include the 'rds:CreateDBInstance' action for all regions.
Why it's wrong here
The policy is scoped to us-east-1, which is where the engineer is likely operating.

Go deeper

DBS-C01 Management and Operations Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question