PAS-C01 Design of SAP Workloads on AWS Practice Question

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject",
        "s3:DeleteObject"
      ],
      "Resource": "arn:aws:s3:::sap-backup-bucket/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ec2:CreateSnapshot",
        "ec2:DescribeSnapshots"
      ],
      "Resource": "*"
    }
  ]
}

An SAP administrator is creating an IAM policy for an EC2 instance that performs SAP database backups to S3 and creates EBS snapshots. The policy as shown fails to allow the EC2 instance to perform backup operations. What is the most likely reason?

⚠ Common exam trap

The trap here is that candidates focus on the EC2 snapshot permissions or S3 object ARN syntax, overlooking the prerequisite `s3:ListBucket` action required for any S3 upload workflow.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The policy does not include the 's3:ListBucket' action for the bucket itself.

The policy lacks the `s3:ListBucket` action for the bucket itself (ARN without `/*`). When an EC2 instance performs SAP database backups to S3, the AWS SDK or CLI first issues a `ListBucket` request to verify the bucket exists and to list objects before uploading. Without this permission, the backup operation fails at the initial listing step, even if `s3:PutObject` is allowed on the object ARN.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The S3 resource ARN is incorrect; it should be 'arn:aws:s3:::sap-backup-bucket' without the '/*'.
Why it's wrong here
The ARN with '/*' is correct for object-level actions; list bucket requires the bucket ARN without '/*'.
✗
The S3 actions are too permissive; they should be restricted to specific prefixes.
Why it's wrong here
The actions are appropriate for backup operations; the issue is not over-permissiveness.
✗
The ec2:CreateSnapshot action must be restricted to specific volume ARNs.
Why it's wrong here
While best practice, it is not required; the policy works without volume ARN restriction.
✓
The policy does not include the 's3:ListBucket' action for the bucket itself.
Why this is correct
Without 's3:ListBucket' on the bucket resource, the instance cannot list objects or verify bucket existence, causing failures.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

PAS-C01 Design of SAP Workloads on AWS Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question