DOP-C02 Configuration Management and IaC Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Add a Condition block: "Condition": {"StringEquals": {"aws:PrincipalTag/Environment": "Production"}}

  Why it's wrong here

  This condition uses aws:PrincipalTag, which reads tags attached to the IAM principal (user or role) making the API call, not tags on the EC2 instance. As a result, it would allow the actions if the caller has a Production tag on their own user/role, regardless of whether the instance itself has that tag — so it fails to enforce the intended resource-level restriction and could grant access to non-Production instances. For EC2 resource controls, you must use ec2:ResourceTag/Environment instead.

• ✗

  Change the Action to "ec2:Describe*" and add a NotAction element.

  Why it's wrong here

  This alternative changes the allowed actions to only ec2:Describe* and adds a NotAction element, but NotAction is meant for exclusionary deny statements, not for conditionally allowing a subset of actions on tagged resources. Moreover, ec2:Describe* calls are read-only and do not include the management operations the policy likely needs to permit, so the change would either over-broaden or break the intended permissions. To restrict specific actions to tagged instances, keep the Action list as-is and attach a Condition using ec2:ResourceTag/Environment.

• ✓

  Add a Condition block: "Condition": {"StringEquals": {"ec2:ResourceTag/Environment": "Production"}}

  Why this is correct

  This is correct because ec2:ResourceTag/Environment is the IAM condition key that checks the value of the Environment tag on the EC2 resource (instance, volume, etc.) that the request targets, and StringEquals ensures the tag must exactly equal "Production". By adding this Condition block to the policy statement, the allowed actions are only granted when the resource being acted upon carries that tag, effectively scoping permissions to Production instances. This is the standard pattern for tag-based, resource-level access control for EC2.

• ✗

  Add a Condition block: "Condition": {"StringEquals": {"aws:RequestTag/Environment": "Production"}}

  Why it's wrong here

  The aws:RequestTag condition key inspects tags that are supplied in the API request itself, such as tags specified when creating an instance, not tags already existing on a resource. For actions that operate on an existing EC2 instance, the request typically does not include the instance's current tags, so this condition would always evaluate to false (or behave unpredictably) and would not restrict access to Production instances. Use ec2:ResourceTag to evaluate the resource's actual tags at authorization time.

Go deeper

Related to this question