A data scientist is trying to create a training job named 'test-model' using an IAM role with the attached policy. The creation fails with an AccessDenied error. What is the most likely cause?
Wildcards are not supported in StringNotEquals conditions, causing unexpected denial.
Why this answer
The Deny statement uses 'StringNotEquals' with a wildcard '*' in the condition value, which is not supported for the 'StringNotEquals' condition operator in IAM policies. The 'StringNotEquals' operator requires exact string matching and does not support wildcards; using '*' will cause the condition to never match, effectively making the Deny statement non-functional or causing unexpected behavior. This mismatch leads to an AccessDenied error because the policy evaluation fails to properly deny or allow the action.
Exam trap
The trap here is that candidates may assume 'StringNotEquals' supports wildcards like 'StringNotLike' does, or they may focus on the Resource wildcard (Option A) as the obvious cause, missing the subtle condition operator mismatch.
How to eliminate wrong answers
Option A is wrong because setting the Resource to '*' is generally acceptable for service-linked roles or broad permissions, and the error is specifically about an AccessDenied due to a policy condition issue, not resource specificity. Option B is wrong because 'StringNotEquals' is a valid condition operator; the issue is not the operator itself but the use of a wildcard in its value, which is unsupported. Option C is wrong because the IAM role's ability to assume the SageMaker execution role is a separate permission (sts:AssumeRole) and not directly related to the training job creation failure caused by the Deny statement's condition syntax.