ANS-C01 Network Security, Compliance and Governance Practice Question

Exhibit

Refer to the exhibit.

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowVPCAccess",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::123456789012:role/AdminRole"
            },
            "Action": "ec2:AcceptVpcPeeringConnection",
            "Resource": "arn:aws:ec2:us-east-1:123456789012:vpc-peering-connection/*",
            "Condition": {
                "StringEquals": {
                    "ec2:AccepterVpc": "arn:aws:ec2:us-east-1:123456789012:vpc/vpc-0abcdef1234567890"
                }
            }
        }
    ]
}
```

Refer to the exhibit. An AWS IAM policy is attached to an IAM role used by a network administrator. The policy is intended to allow the role to accept a VPC peering connection request only if the accepter VPC is vpc-0abcdef1234567890. However, the administrator reports that the policy does not work as expected. What is the most likely reason?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The condition key is misspelled; it should be ec2:AccepterVpc (with capital A)

AWS condition keys are case-sensitive. The correct condition key for restricting the accepter VPC is `ec2:AccepterVpc` (with capital A and V). A common mistake is using `ec2:accepterVpc` (lowercase 'a'), which causes the condition to be ignored and the policy to not work as intended. The other options are incorrect: the `ec2:AcceptVpcPeeringConnection` action does not require `ec2:Describe*` permissions; a wildcard in the resource ARN is permissible when the condition restricts access to a specific VPC; and identity-based policies attached to a role do not include a Principal element.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The policy does not include the ec2:Describe* action, which is required to accept a peering connection
Why it's wrong here
The Describe action is not required for accepting a peering connection.
✗
The resource ARN should include the specific peering connection ID instead of a wildcard
Why it's wrong here
A wildcard is acceptable for the resource ARN.
✓
The condition key is misspelled; it should be ec2:AccepterVpc (with capital A)
Why this is correct
The condition key is case-sensitive; the correct key is ec2:AccepterVpc (capital A).
✗
The Principal element must specify the AWS account ID instead of the IAM role ARN
Why it's wrong here
The Principal element can specify a role ARN.

Go deeper

ANS-C01 Network Security, Compliance and Governance Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question