DBS-C01 Deployment and Migration Practice Question

Exhibit

Refer to the exhibit.

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "rds:CreateDBInstance",
        "rds:DescribeDBInstances",
        "rds:DeleteDBInstance"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Deny",
      "Action": "rds:ModifyDBInstance",
      "Resource": "arn:aws:rds:us-east-1:123456789012:db:prod-*"
    }
  ]
}
```

An IAM policy is attached to a user who is deploying a new RDS instance. What is the effect of this policy on the user's ability to modify an existing production database instance with the identifier 'prod-mydb'?

⚠ Common exam trap

Candidates often assume an Allow statement with full access will override a Deny, but AWS IAM explicitly prioritizes Deny over Allow, and the Deny's resource condition restricts the effect to only the named production database, not all databases.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The user cannot modify the production database instance because the Deny statement explicitly denies ModifyDBInstance on production databases.

The IAM policy includes an explicit Deny statement that denies the `rds:ModifyDBInstance` action when the resource condition matches `arn:aws:rds:*:*:db:prod-mydb`. In IAM, an explicit Deny overrides any Allow, so even though the Allow statement grants full RDS access, the Deny takes precedence and blocks modification of the production database instance with identifier 'prod-mydb'.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The user cannot modify the production database instance because the Deny statement explicitly denies ModifyDBInstance on production databases.
Why this is correct
Deny overrides Allow, and the resource pattern matches the production database.
✗
The user can modify the production database instance because the Allow statement grants full access to RDS actions.
Why it's wrong here
The Allow statement does not include ModifyDBInstance, and the Deny explicitly denies it.
✗
The user can modify the production database instance if they use the AWS CLI instead of the console.
Why it's wrong here
IAM policies apply to all API calls, regardless of interface.
✗
The user cannot modify any database instance because the Deny statement denies ModifyDBInstance on all resources.
Why it's wrong here
The Deny only applies to resources matching the specific ARN pattern for production databases.

Go deeper

DBS-C01 Deployment and Migration Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question