ANS-C01 Network Design Practice Question

Exhibit

Refer to the exhibit.

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:CreateVpcPeeringConnection",
        "ec2:AcceptVpcPeeringConnection",
        "ec2:DeleteVpcPeeringConnection"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "ec2:CreateRoute",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "ec2:Vpc": ["arn:aws:ec2:us-east-1:111111111111:vpc/vpc-11111111"]
        }
      }
    }
  ]
}
```

An IAM policy is attached to a user who needs to manage VPC peering connections. The policy allows creating and accepting peering connections, but the user reports they cannot add routes to the route table of their VPC (vpc-11111111) for the peered connection. What is the most likely cause?

⚠ Common exam trap

AWS often tests the misconception that route table modifications are solely governed by the `ec2:CreateRoute` action, ignoring that IAM conditions like `ec2:Vpc` can restrict the operation based on the route table's associated VPC, leading candidates to incorrectly choose Option B.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The condition in the policy restricts the VPC, but the route table is not associated with that VPC.

The IAM policy includes a condition that restricts the VPC (e.g., `ec2:Vpc` condition key set to `vpc-11111111`), but the route table the user is trying to modify is not associated with that VPC. Even though the user has permissions to create and accept peering connections, the condition on the route table modification action (like `ec2:CreateRoute`) limits the operation to route tables belonging to the specified VPC. Since the route table belongs to a different VPC or is not associated with `vpc-11111111`, the request fails.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The condition in the policy restricts the VPC, but the route table is not associated with that VPC.
Why this is correct
Condition limits to specific VPC ARN, but route table may have different ARN.
✗
The user does not have permission to create routes.
Why it's wrong here
Action is allowed.
✗
The user needs additional permissions for the peering connection.
Why it's wrong here
Peering permissions are already granted.
✗
The user needs to accept the peering connection first.
Why it's wrong here
Not related.

Go deeper

ANS-C01 Network Design Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question