IAM Policy for Cross-Account VPC Peering
Exhibit
Refer to the exhibit.
IAM policy JSON:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:CreateVpcPeeringConnection",
"ec2:AcceptVpcPeeringConnection",
"ec2:DeleteVpcPeeringConnection"
],
"Resource": "*"
}
]
}Refer to the exhibit. A network engineer has this IAM policy attached to their user. They attempt to create a VPC peering connection between VPC A (in account 123456789012) and VPC B (in account 210987654321). The request fails. Which additional permission is required?
Quick Answer
The correct answer is that the policy must include a condition restricting the accepter VPC owner to the target account. When creating a cross-account VPC peering connection, the requester’s IAM policy must explicitly authorize the action for a specific accepter account using a condition key like ec2:AccepterVpcOwnerId or aws:SourceAccount; without this, the ec2:CreateVpcPeeringConnection call fails because the policy lacks the required cross-account authorization context. On the AWS Certified Advanced Networking Specialty ANS-C01 exam, this scenario tests your understanding of how IAM policies enforce resource-based permissions across accounts, often appearing as a trick where a seemingly permissive policy still fails due to missing conditions. A common trap is assuming that allowing the action alone is sufficient, but AWS requires explicit account-level scoping for cross-account operations. Remember the mnemonic “Peering without a condition is a permission omission”—always check for the accepter account condition.
⚠ Common exam trap
The ANS-C01 exam often tests the misconception that the ec2:CreateVpcPeeringConnection action alone is sufficient for cross-account peering, but the trap is that the IAM policy must include a condition to specify the accepter account ID, otherwise the request fails due to missing authorization context.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The policy must include a condition that the accepter VPC owner is the target account.
When creating a VPC peering connection across AWS accounts, the requester's IAM policy must include a condition that explicitly allows the action only when the accepter VPC owner is the target account. Without this condition, the ec2:CreateVpcPeeringConnection action will fail because the policy lacks the necessary cross-account authorization context. The condition key aws:SourceAccount or ec2:AccepterVpcOwnerId must be used to restrict the action to the specific accepter account.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The ec2:CreateVpcPeeringConnection action is not allowed on the accepter VPC.
Why it's wrong here
The action is allowed with Resource "*".
- ✓
The policy must include a condition that the accepter VPC owner is the target account.
Why this is correct
Without a condition, the peering request may be denied if the accepter account is not specified.
- ✗
The user needs ec2:ModifyVpcPeeringConnectionOptions permission.
Why it's wrong here
Not required for creation.
- ✗
The user needs ec2:CreateVpcEndpoint permission.
Why it's wrong here
VPC endpoints are not related to peering.
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An IAM policy is attached to a user who needs to manage VPC peering connections. The policy allows creating and accepting peering connections, but the user reports they cannot add routes to the route table of their VPC (vpc-11111111) for the peered connection. What is the most likely cause?
hard- ✓ A.The condition in the policy restricts the VPC, but the route table is not associated with that VPC.
- B.The user does not have permission to create routes.
- C.The user needs additional permissions for the peering connection.
- D.The user needs to accept the peering connection first.
Why A: The IAM policy includes a condition that restricts the VPC (e.g., `ec2:Vpc` condition key set to `vpc-11111111`), but the route table the user is trying to modify is not associated with that VPC. Even though the user has permissions to create and accept peering connections, the condition on the route table modification action (like `ec2:CreateRoute`) limits the operation to route tables belonging to the specified VPC. Since the route table belongs to a different VPC or is not associated with `vpc-11111111`, the request fails.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.