ANS-C01 Network Management and Operations Practice Question

Exhibit

Refer to the exhibit.

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:CreateFlowLogs",
        "ec2:DescribeFlowLogs",
        "ec2:DeleteFlowLogs"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents",
        "logs:DescribeLogGroups"
      ],
      "Resource": "arn:aws:logs:us-east-1:123456789012:log-group:/aws/vpc-flow-logs/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "iam:PassRole"
      ],
      "Resource": "arn:aws:iam::123456789012:role/FlowLogsRole"
    }
  ]
}
```

A network engineer created an IAM policy for a user to manage VPC Flow Logs. The user reports they cannot create flow logs and receive an 'AccessDenied' error. What is the MOST likely reason?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The logs:CreateLogGroup resource ARN is too restrictive.

The logs:CreateLogGroup action is required to create a log group for VPC Flow Logs. If the IAM policy grants this action but restricts the resource ARN to a specific log group name (e.g., arn:aws:logs:us-east-1:123456789012:log-group:my-log-group:*), the user will get an AccessDenied error when trying to create a flow log that would create a log group with a different name. Options A, C, and D are less likely because the policy may include those actions but the resource restriction on logs:CreateLogGroup is the most common cause.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The ec2:CreateFlowLogs action is missing.
Why it's wrong here
The policy includes ec2:CreateFlowLogs.
✓
The logs:CreateLogGroup resource ARN is too restrictive.
Why this is correct
The resource ARN limits log group creation to names starting with '/aws/vpc-flow-logs/', but the user might be using a different name.
✗
The logs:PutLogEvents action is missing.
Why it's wrong here
The policy includes logs:PutLogEvents.
✗
The iam:PassRole action is missing for the flow logs role.
Why it's wrong here
The policy includes iam:PassRole for the specific role.

Go deeper

ANS-C01 Network Management and Operations Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question