SAP-C02 Practice Question: Design Solutions for Organizational Complexity

Exhibit

Refer to the exhibit.

Resource: AWS::IAM::Role
Properties:
  RoleName: MyRole
  AssumeRolePolicyDocument:
    Version: 2012-10-17
    Statement:
      - Effect: Allow
        Principal:
          Service: ec2.amazonaws.com
        Action: sts:AssumeRole
  Policies:
    - PolicyName: S3Access
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action: s3:GetObject
            Resource: arn:aws:s3:::my-bucket/*
  Tags:
    - Key: Environment
      Value: Production

Refer to the exhibit. A CloudFormation template is used to create an IAM role for EC2. The stack creation fails with the error: "Resource creation cancelled". The IAM role is not created. What is the MOST likely reason?

⚠ Common exam trap

Test-takers frequently confuse 'Resource creation cancelled' with permission or policy errors, but it specifically indicates a conflict or failure during resource creation, such as a duplicate name, rather than a missing capability or incorrect trust policy.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The IAM role name already exists in the account

The error 'Resource creation cancelled' typically occurs when CloudFormation attempts to create a resource that already exists in the account and the resource is not configured for updates or replacement. Since the IAM role name is globally unique within an AWS account, if a role with the same name already exists, CloudFormation will fail to create it and cancel the operation, leaving the role uncreated.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The trust policy does not include the correct service principal for EC2
Why it's wrong here
ec2.amazonaws.com is correct.
✓
The IAM role name already exists in the account
Why this is correct
IAM role names must be unique within an account.
✗
The template does not have the required IAM capabilities
Why it's wrong here
Missing capabilities would give a different error.
✗
The role does not have an instance profile
Why it's wrong here
Instance profile is not required for role creation.

Go deeper

SAP-C02 Practice Question: Design Solutions for Organizational Complexity

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question