DBS-C01 Deployment and Migration Practice Question

Exhibit

Refer to the exhibit.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "dms:CreateReplicationTask",
                "dms:StartReplicationTask",
                "dms:DescribeReplicationTasks"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "rds:DescribeDBInstances",
                "rds:ModifyDBInstance"
            ],
            "Resource": "*"
        }
    ]
}

Refer to the exhibit. An IAM policy is attached to a user who will manage AWS DMS tasks. When the user tries to start a replication task, they receive an access denied error. What is the most likely cause?

⚠ Common exam trap

Candidates often assume the error is due to a missing start action (Option B) when the policy actually includes it, but they overlook that DMS requires additional describe permissions for endpoints and connections as a prerequisite to starting a task.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The policy is missing permissions to describe endpoints and connections

The DMS API requires that a user have permissions to describe endpoints and connections before starting a replication task. Even if the policy grants dms:StartReplicationTask, the service internally calls dms:DescribeEndpoints and dms:DescribeConnections to validate the source and target endpoints. Without those describe permissions, the API call fails with an access denied error, even though the start action itself is allowed.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The policy does not allow rds:DescribeDBInstances
Why it's wrong here
The policy includes rds:DescribeDBInstances.
✗
The policy does not allow the dms:StartReplicationTask action
Why it's wrong here
The policy includes dms:StartReplicationTask, so this is not the issue.
✓
The policy is missing permissions to describe endpoints and connections
Why this is correct
To start a replication task, DMS needs to describe endpoints and connections; these actions are missing from the policy.
✗
The policy does not allow dms:CreateReplicationTask
Why it's wrong here
The policy includes dms:CreateReplicationTask.

Go deeper

DBS-C01 Deployment and Migration Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question