An SAP administrator created the IAM policy shown in the exhibit. When trying to terminate an EC2 instance with ID i-abc123 in us-west-2, the action fails. What is the reason?
The resource ARN specifies us-east-1, so terminating instances in other regions is denied.
Why this answer
The policy includes a condition that restricts the ec2:TerminateInstances action to the us-east-1 region using the ec2:Region condition key. Since the instance i-abc123 is in us-west-2, the condition is not satisfied, causing the action to fail. AWS IAM policies evaluate conditions before allowing an action, and if the condition is not met, the action is denied.
Exam trap
The trap here is that candidates often overlook the condition key in the policy and assume the action is universally allowed, failing to realize that conditions can restrict actions to specific regions, resources, or other attributes, leading them to incorrectly choose the implicit deny option.
How to eliminate wrong answers
Option A is wrong because an implicit Deny applies only to actions not explicitly allowed, but here the ec2:TerminateInstances action is explicitly allowed with a condition that is not met, resulting in an explicit deny from the condition evaluation, not an implicit deny. Option C is wrong because the policy does not require a condition key to allow termination in us-west-2; rather, the existing condition explicitly restricts termination to us-east-1, and adding a condition key for us-west-2 would not override the current restriction without modifying the condition. Option D is wrong because the ec2:StartInstances and ec2:StopInstances actions are irrelevant to the failure; the issue is specifically with ec2:TerminateInstances, and those actions are not mentioned in the policy or the scenario.