DBS-C01 Monitoring and Troubleshooting Practice Question

Exhibit

Refer to the exhibit.

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "rds:DescribeDBInstances",
                "rds:ListTagsForResource"
            ],
            "Resource": "arn:aws:rds:us-east-1:123456789012:db:mydb"
        },
        {
            "Effect": "Allow",
            "Action": "rds:CreateDBSnapshot",
            "Resource": "arn:aws:rds:us-east-1:123456789012:snapshot:*"
        }
    ]
}
```

Refer to the exhibit. A database specialist is troubleshooting an automation script that fails when trying to create a snapshot of the RDS DB instance 'mydb' using an IAM role with the attached policy. The error message indicates that the user is not authorized to perform the operation. Which statement best explains the failure?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The policy does not grant the rds:CreateDBSnapshot permission on the DB instance resource.

The rds:CreateDBSnapshot action requires permission on the DB instance resource (arn:aws:rds:region:account:db:instance-name). The IAM policy in the exhibit only grants this action on the snapshot resource (arn:aws:rds:region:account:snapshot:*), not on the DB instance, causing the authorization failure. Options A and B are incorrect because they either mention an irrelevant action or misidentify the resource. Option C is incorrect because the policy does allow rds:CreateDBSnapshot on the snapshot resource, but the missing permission on the DB instance is the actual issue.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The resource ARN for the snapshot is incorrect; it should specify the DB instance ID.
Why it's wrong here
Snapshot ARN is correct; the issue is missing permission on the DB instance.
✗
The policy does not allow the rds:DescribeDBInstances action on the snapshot resource.
Why it's wrong here
DescribeDBInstances is not needed for creating snapshots.
✗
The policy does not allow the rds:CreateDBSnapshot action on the specific snapshot name.
Why it's wrong here
The action is allowed on all snapshots.
✓
The policy does not grant the rds:CreateDBSnapshot permission on the DB instance resource.
Why this is correct
CreateDBSnapshot requires permission on the DB instance.

Go deeper

DBS-C01 Monitoring and Troubleshooting Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question