Understand Terraform basics →mediumMultiple ChoiceObjective-mapped

TF-004 Understand Terraform basics Practice Question

Exhibit

$ terraform plan

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # aws_instance.web will be created
  + resource "aws_instance" "web" {
      + ami                          = "ami-0c55b159cbfafe1f0"
      + instance_type                = "t2.micro"
      + tags                         = {
          + "Name" = "WebServer"
        }
    }

Plan: 1 to add, 0 to change, 0 to destroy.

Refer to the exhibit. A user runs 'terraform plan' and sees this output. However, when they run 'terraform apply', they get an error: 'Error creating EC2 instance: UnauthorizedOperation: You are not authorized to perform this operation.' The user's IAM permissions allow ec2:RunInstances. What is the most likely missing permission?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

ec2:CreateNetworkInterface

Creating an EC2 instance often requires permissions for related resources like network interfaces, security groups, etc. The error 'UnauthorizedOperation' despite having ec2:RunInstances suggests missing permissions for other actions. Option A is correct because the instance might require a subnet and network interface, and without ec2:CreateNetworkInterface permission, the operation fails.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
ec2:CreateNetworkInterface
Why this is correct
When creating an EC2 instance, AWS automatically provisions a primary network interface (ENI) for it, even if not explicitly configured in Terraform. This ENI handles network connectivity, including IP addresses and security groups. The `UnauthorizedOperation` error during `terraform plan` for an EC2 instance creation often indicates that the IAM principal (user or role) executing Terraform lacks the necessary `ec2:CreateNetworkInterface` permission to perform this underlying AWS API call. Without this permission, the instance provisioning fails at a fundamental networking step.
✗
iam:PassRole
Why it's wrong here
The `iam:PassRole` permission is specifically required when an IAM role is attached to an EC2 instance profile during its creation. This permission grants the principal (e.g., Terraform's execution role) the authority to "pass" an existing IAM role to another AWS service, ensuring that the service (in this case, EC2) can assume that role. Since the provided configuration does not specify an `iam_instance_profile` or `iam_role` for the EC2 instance, this permission is not relevant to the `UnauthorizedOperation` error observed.
✗
ec2:TerminateInstances
Why it's wrong here
The `ec2:TerminateInstances` permission grants the ability to stop and permanently delete running EC2 instances. This action is part of the instance lifecycle management, specifically for destruction, not creation. When `terraform plan` is executed for a new resource, Terraform is evaluating the steps required to *create* that resource, not destroy it. Therefore, a missing `TerminateInstances` permission would not cause an `UnauthorizedOperation` error during the planning phase for a new instance.
✗
ec2:DescribeInstances
Why it's wrong here
`ec2:DescribeInstances` is a read-only permission used to retrieve information about existing EC2 instances, such as their state, tags, and network configurations. While Terraform often uses `Describe` permissions to read the current state of resources in AWS, these are typically required for refreshing the state or importing resources, not for the initial creation of a *new* resource. An `UnauthorizedOperation` error during `terraform plan` for a new instance creation indicates a lack of permission to *perform* a creation action, not to *read* existing resources.

Visual reference

Go deeper

TF-004 Understand Terraform basics Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question