DBS-C01 Monitoring and Troubleshooting Practice Question

Exhibit

Refer to the exhibit.

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "rds:DescribeDBInstances",
        "cloudwatch:GetMetricStatistics",
        "cloudwatch:ListMetrics"
      ],
      "Resource": "*"
    }
  ]
}
```

Refer to the exhibit. A DBA is troubleshooting an issue where an IAM user cannot view CloudWatch metrics for an RDS DB instance. The IAM policy attached to the user is shown above. What is the MOST likely reason the user cannot view the metrics?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The policy does not include cloudwatch:DescribeAlarms

The IAM policy includes 'cloudwatch:GetMetricStatistics' and 'cloudwatch:ListMetrics', which should allow retrieving metric data via API. However, the AWS Management Console for CloudWatch Metrics also requires 'cloudwatch:DescribeAlarms' to display alarm overlays on the metrics graph. Without this action, the console may fail to load the metrics page entirely. Option A is correct because the missing permission is 'cloudwatch:DescribeAlarms'. Option B is incorrect because 'rds:DescribeDBInstances' is not needed to view metrics; the policy already includes it. Option C is incorrect because using a Resource of '*' is allowed for CloudWatch actions; it does not prevent viewing metrics. Option D is incorrect because 'cloudwatch:GetMetricStatistics' is already present in the policy.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The policy does not include cloudwatch:DescribeAlarms
Why this is correct
The CloudWatch console often requires DescribeAlarms to view metrics.
✗
The policy does not include rds:DescribeDBInstances
Why it's wrong here
The policy includes rds:DescribeDBInstances.
✗
The policy uses a Resource element of '*' which is not allowed for CloudWatch
Why it's wrong here
CloudWatch supports '*' resource.
✗
The policy does not include cloudwatch:GetMetricStatistics
Why it's wrong here
The policy includes cloudwatch:GetMetricStatistics.

Go deeper

DBS-C01 Monitoring and Troubleshooting Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question