AWS DMS IAM Permissions for SAP Migration
Exhibit
Refer to the exhibit.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"dms:CreateReplicationTask",
"dms:StartReplicationTask",
"dms:DescribeReplicationTasks"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:PutObject"
],
"Resource": "arn:aws:s3:::my-bucket/*"
},
{
"Effect": "Allow",
"Action": [
"ec2:DescribeVpcs",
"ec2:DescribeSubnets",
"ec2:DescribeSecurityGroups"
],
"Resource": "*"
}
]
}An IAM policy for a migration team is shown in the exhibit. The team is unable to start a DMS replication task. What is the most likely missing permission?
Quick Answer
The answer is the missing permissions are dms:CreateReplicationInstance and dms:CreateEndpoint. This is because AWS DMS requires explicit IAM permissions to provision the underlying infrastructure for a migration task, including creating the replication instance that processes the data and the endpoints that connect to source and target databases. Without these actions, the DMS service cannot allocate the necessary compute resources or establish the database connections, even if other permissions like S3 or EC2 Describe are present. On the AWS Certified SAP on AWS Specialty PAS-C01 exam, this tests your understanding of the principle of least privilege and the specific resource lifecycle actions DMS needs, often appearing as a trap where candidates assume read-only or describe permissions are sufficient. A common memory tip is “DMS needs to build before it can move”—think of CreateReplicationInstance and CreateEndpoint as the “build” permissions that are frequently overlooked in migration-focused policies.
⚠ Common exam trap
Candidates often confuse the permissions needed to create DMS resources with those needed to start a task. Starting a task requires dms:StartReplicationTask and ec2:CreateNetworkInterface, not the create actions for instances or endpoints.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ec2:CreateNetworkInterface
To start a DMS replication task, the IAM policy must include permissions for DMS to create network interfaces in the VPC. The ec2:CreateNetworkInterface permission is required because DMS dynamically creates an elastic network interface for the replication instance when the task starts. The other options are not the most likely missing permission: dms:CreateReplicationInstance and dms:CreateEndpoint are needed for creating resources, not for starting an existing task; s3:ListBucket is unrelated; kms:Decrypt is only needed if using encrypted endpoints, which is not indicated.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
dms:CreateReplicationInstance and dms:CreateEndpoint
Why it's wrong here
Incorrect. These permissions are required to create a replication instance and endpoints, but the task already exists. Starting a task does not require create actions.
- ✗
s3:ListBucket
Why it's wrong here
Incorrect. S3 permissions like s3:ListBucket are not directly needed to start a DMS replication task.
- ✗
kms:Decrypt
Why it's wrong here
Incorrect. kms:Decrypt is only required if the replication task uses encrypted endpoints, which is not mentioned.
- ✓
ec2:CreateNetworkInterface
Why this is correct
Correct. DMS uses ec2:CreateNetworkInterface to create an elastic network interface in the VPC for the replication instance when starting a task. Without this permission, the task fails to start.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every PAS-C01 question from scratch — 1,616 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on PAS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. A migration engineer is setting up an IAM policy for an AWS DMS task that will replicate data from an on-premises SAP ASE database to Amazon RDS for SAP ASE. The engineer wants to ensure the DMS task can be created and started. What is missing from this policy?
medium- ✓ A.Permissions to create DMS endpoints (dms:CreateEndpoint)
- B.Permissions to describe DMS replication instances
- C.Permissions to start and stop replication tasks
- D.Permissions to use AWS Key Management Service (KMS) for encryption
Why A: Creating endpoints is a prerequisite for running a DMS task, and the provided policy does not include 'dms:CreateEndpoint'. Option B is incorrect because the policy does not include 'dms:DescribeReplicationInstances', but that is not required to create or start the task; the issue is missing endpoint creation permissions. Option C is incorrect because the policy does include 'dms:StartReplicationTask', so starting the task is allowed once endpoints exist. Option D is incorrect because the policy does not reference KMS actions, and encryption via KMS would require additional permissions, but that is not the immediate missing piece for creating and starting the task.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.