DVA-C02 Deployment Practice Question

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "codedeploy:RegisterApplicationRevision",
        "codedeploy:GetDeploymentGroup"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject"
      ],
      "Resource": "arn:aws:s3:::my-bucket/*"
    }
  ]
}

An IAM policy is attached to an EC2 instance role. The instance is part of a CodeDeploy deployment group. The deployment fails because the CodeDeploy agent cannot download the revision. What is the most likely reason?

⚠ Common exam trap

A common mix-up: candidates confuse the permissions needed by the CodeDeploy agent (S3 read access) with the permissions needed by the user or pipeline (CodeDeploy API actions), leading them to select a CodeDeploy action instead of the correct S3 action.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The policy does not allow s3:GetObject on the specific bucket where the revision is stored.

The CodeDeploy agent on the EC2 instance downloads the application revision from an S3 bucket. For this to succeed, the IAM role attached to the instance must include an s3:GetObject permission on the specific bucket and object. Without it, the agent cannot retrieve the revision file, causing the deployment to fail. Options A and B are irrelevant because the agent does not call CodeDeploy API actions like GetDeployment or CreateDeployment; those are used by the user or CI/CD pipeline initiating the deployment. Option C is incorrect because IAM policies for S3 actions do not require a region in the resource ARN.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The policy does not allow the codedeploy:GetDeployment action.
Why it's wrong here
This policy statement is incorrect because the CodeDeploy agent running on an EC2 instance typically does not require the `codedeploy:GetDeployment` action. The agent's primary role is to receive and execute deployment instructions for its specific deployment group, not to query the overall status or details of a specific deployment ID. Permissions like `codedeploy:GetDeploymentGroup` and `codedeploy:RegisterApplicationRevision` are more relevant for the agent's operational needs.
✗
The policy does not allow the codedeploy:CreateDeployment action.
Why it's wrong here
This policy statement is incorrect because an EC2 instance, acting as a deployment target, does not initiate or create deployments. The `codedeploy:CreateDeployment` action is typically performed by a CI/CD pipeline, a developer, or an automation script to start a new deployment process. The CodeDeploy agent on the instance is responsible for receiving and applying the deployment, not for its creation.
✗
The policy does not specify a region in the resource ARN.
Why it's wrong here
This policy statement is incorrect because specifying a region in the resource ARN is not universally required for all AWS services or actions. For S3 buckets, for instance, the bucket name is globally unique, and the region is often omitted in the ARN, as the service handles regional routing implicitly. For CodeDeploy actions, if the policy is applied within the same region as the CodeDeploy application and deployment group, the region segment in the ARN might also be optional or handled contextually by the service.
✓
The policy does not allow s3:GetObject on the specific bucket where the revision is stored.
Why this is correct
This policy statement correctly identifies a common issue: the CodeDeploy agent needs explicit `s3:GetObject` permissions for the *exact* S3 bucket and path where the application revision is stored. If the IAM policy only grants access to a generic bucket like 'my-bucket', but the actual deployment package resides in a different bucket, such as 'another-bucket', the agent will be unable to download the necessary files, causing the deployment to fail due to an access denied error.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

DVA-C02 Deployment Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question