Correct IAM Condition Key Format for CodeCommit Branch Restrictions
Exhibit
Refer to the exhibit.
```
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"codecommit:GitPull",
"codecommit:GitPush"
],
"Resource": "arn:aws:codecommit:us-east-1:123456789012:MyRepo",
"Condition": {
"StringEquals": {
"codecommit:References": ["refs/heads/main"]
}
}
}
]
}
```An IAM policy is attached to a user. The user is trying to push a commit to the 'main' branch of the 'MyRepo' repository. The push is denied. What is the most likely reason?
Quick Answer
The answer is that the condition key 'codecommit:References' is not correctly formatted for an array value. This is the most likely reason the push is denied because when using StringEquals in an IAM policy, the condition key expects a single string value, not an array; to properly restrict a branch with multiple reference values, you must use either ForAllValues:StringEquals or ForAnyValue:StringEquals to handle array matching correctly. On the AWS Certified DevOps Engineer Professional DOP-C02 exam, this tests your understanding of how IAM condition keys interact with array-based values in CodeCommit policies, a common trap where candidates mistakenly use StringEquals with a list of branch names. Remember the memory tip: "StringEquals is singular, ForAllValues is plural" — if you see an array of branch references, never use plain StringEquals.
⚠ Common exam trap
Many candidates assume the denial is due to a missing action permission (Option B) or a generic resource ARN issue (Option C), overlooking the subtle requirement that the 'codecommit:References' condition key must be formatted as an array value to work correctly with branch-specific restrictions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The condition key 'codecommit:References' is not correctly formatted for an array value.
The condition key 'codecommit:References' must be formatted as an array value when used in an IAM policy to restrict pushes to specific branches. If the policy uses a string value instead of an array (e.g., 'refs/heads/main' instead of ['refs/heads/main']), the condition fails to match, and the push is denied even if the user has the 'codecommit:GitPush' action allowed. This is a common misconfiguration in IAM policies for CodeCommit.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The user does not have permission to push to any branch.
Why it's wrong here
The policy allows push to main branch.
- ✗
The policy does not allow the 'codecommit:GitPush' action for the main branch.
Why it's wrong here
The policy allows GitPush for main branch.
- ✗
The resource ARN is incorrect.
Why it's wrong here
The ARN is valid.
- ✓
The condition key 'codecommit:References' is not correctly formatted for an array value.
Why this is correct
StringEquals with an array is invalid; should use set operators.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DOP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. An IAM policy is attached to a user. The user reports that they cannot push to the 'MyRepo' repository. What is the likely reason?
medium- ✓ A.The policy does not allow GitPush on the repository's branches.
- B.The user is not in the correct IAM group.
- C.The user does not have GitPull permission on the repository.
- D.The policy must include codecommit:CreateRepository action.
Why A: The IAM policy shown in the exhibit likely includes a condition or resource restriction that limits the `codecommit:GitPush` action to specific branches, or the policy is missing the `codecommit:GitPush` action entirely. Without explicit permission to push to the repository's branches, the user will receive an access denied error when attempting to push changes. AWS CodeCommit uses IAM policies to control Git operations, and `GitPush` must be allowed on the repository ARN (e.g., `arn:aws:codecommit:region:account:MyRepo`) and optionally on specific branch references using conditions.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.