DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  {"Effect":"Allow","Action":"iam:*AccessKey*","Resource":"arn:aws:iam::*:user/${aws:username}"}

  Why this is correct

  This policy correctly grants comprehensive permissions for managing access keys through the `iam:*AccessKey*` action wildcard, which includes actions like Create, Delete, and Update. Crucially, the `Resource` element utilizes the `arn:aws:iam::*:user/${aws:username}` policy variable. This dynamic variable ensures that the policy's scope is strictly limited to the IAM user's own user resource, allowing them to create, delete, update, and list *only their own* access keys, thereby adhering to the principle of least privilege and the specific requirement.

• ✗

  {"Effect":"Allow","Action":"iam:*AccessKey*","Resource":"arn:aws:iam::*:user/JohnDoe"}

  Why it's wrong here

  While the `iam:*AccessKey*` action correctly provides full management capabilities for access keys, the `Resource` element is explicitly set to `arn:aws:iam::*:user/JohnDoe`. This hardcoded ARN means that any user to whom this policy is attached would be able to manage JohnDoe's access keys, not their own. It fails to meet the requirement for a user to manage *only their own* access keys, as it targets a specific, different user within the account.

• ✗

  {"Effect":"Allow","Action":"iam:*AccessKey*","Resource":"*"}

  Why it's wrong here

  This policy grants broad management permissions for access keys via the `iam:*AccessKey*` action, which covers all relevant CRUD operations. However, specifying `*` as the `Resource` allows the user to perform these actions on *any* IAM user resource within the AWS account. This violates the principle of least privilege and the requirement that the user should manage *only their own* access keys, as it effectively grants permissions to manage access keys for all users.

• ✗

  {"Effect":"Allow","Action":["iam:ListAccessKeys","iam:GetAccessKeyLastUsed"],"Resource":"*"}

  Why it's wrong here

  The `Action` element in this policy is restricted to `iam:ListAccessKeys` and `iam:GetAccessKeyLastUsed`. These actions provide only read-only access to access key information, allowing a user to view but not create, delete, or update access keys. The question requires the ability to "manage" access keys, which implies full CRUD (Create, Read, Update, Delete) capabilities, making these actions insufficient for the stated purpose. The `Resource: "*"` further broadens the scope to all users for these read-only actions, but the primary issue is the lack of management permissions.

Go deeper

Related to this question