SAP-C02 Practice Question: Accelerate Workload Migration and Modernization

Exhibit

Refer to the exhibit.
```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "dms.amazonaws.com"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "aws:SourceAccount": "123456789012"
        }
      }
    }
  ]
}
```

A company is setting up AWS DMS to migrate a database. The trust policy above is attached to the IAM role used by DMS. When testing the connection, DMS reports an authentication error. What is the most likely cause?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The trust policy is correct, but the permissions policy attached to the role does not allow DMS to perform the necessary actions on the source and target databases.

The trust policy is correctly configured to allow the DMS service principal (dms.amazonaws.com) to assume the role, as required. However, an authentication error during connection testing typically indicates that DMS cannot successfully assume the role or that the assumed role lacks the necessary permissions to interact with the source or target databases. Since the trust policy is correct, the most likely cause is that the permissions policy attached to the role does not grant DMS the required actions (e.g., dms:TestConnection, dms:CreateEndpoint) on the database resources. Option D correctly identifies this as the issue.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The trust policy is missing a condition for the DMS replication instance.
Why it's wrong here
No such condition is needed.
✗
The service principal should be dms.amazonaws.com, but it is misspelled.
Why it's wrong here
The principal is correctly specified as dms.amazonaws.com.
✗
The trust policy is missing a region-specific condition.
Why it's wrong here
Region conditions are not required for DMS trust.
✓
The trust policy is correct, but the permissions policy attached to the role does not allow DMS to perform the necessary actions on the source and target databases.
Why this is correct
The trust policy allows DMS to assume the role, but the role's permissions policy must grant access to the databases.

Go deeper

SAP-C02 Practice Question: Accelerate Workload Migration and Modernization

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question