Understand Terraform basics →hardMultiple ChoiceObjective-mapped

TF-004 Understand Terraform basics Practice Question

Exhibit

Error: Error applying IAM policy to role MyRole: MalformedPolicyDocument: The policy is not in the valid JSON format.

status code: 400, request id: ...

on main.tf line 10, in resource "aws_iam_role_policy" "my_policy":
  10:   policy = <<POLICY
  11: {
  12:   "Version": "2012-10-17",
  13:   "Statement": [
  14:     {
  15:       "Effect": "Allow",
  16:       "Action": "s3:ListBucket",
  17:       "Resource": "arn:aws:s3:::my-bucket"
  18:     }
  19:   ]
  20: }
  21: POLICY

Refer to the exhibit. An engineer receives this error when running terraform apply. What is the most likely cause?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The Action element should be an array, not a string.

The error indicates a malformed policy JSON. In IAM policy syntax, the `Action` element must be an array of strings, even if only one action is specified. The provided policy has `"Action": "ec2:DescribeInstances"` (a string), which is invalid; it should be `"Action": ["ec2:DescribeInstances"]`. This is the most likely cause of the error.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The policy JSON is missing a required field like "Sid".
Why it's wrong here
The `Sid` field, which stands for Statement ID, is an optional identifier within an AWS IAM policy statement. Its purpose is to provide a human-readable name for a specific statement, which can be useful for logging, debugging, or referencing specific parts of a policy. However, `Sid` is not a mandatory element for a policy to be syntactically valid or functional; its absence will not cause a parsing error or prevent the policy from being applied successfully by the IAM service.
✓
The Action element should be an array, not a string.
Why this is correct
AWS IAM policy syntax strictly mandates that the `Action` element must be an array of strings, even when only a single action is specified. If the `Action` element is provided as a plain string (e.g., `"s3:GetObject"`) instead of being encapsulated within an array (e.g., `["s3:GetObject"]`), the IAM policy parser will encounter a type mismatch error. This fundamental syntax requirement is a common source of errors and prevents the policy from being correctly interpreted and applied.
✗
The Resource ARN is incorrect because it lacks a region.
Why it's wrong here
For Amazon S3 buckets, the Resource ARN (Amazon Resource Name) follows a specific format that explicitly excludes a region component. The correct ARN structure for an S3 bucket is `arn:aws:s3:::bucket-name`, which reflects its global uniqueness within the AWS partition. Unlike many other AWS services where ARNs typically include a region, omitting the region from an S3 bucket ARN is the correct and expected format, and therefore, it is not an error.
✗
The policy exceeds the maximum size limit.
Why it's wrong here
AWS IAM policies have specific size limits, typically 2KB for inline policies and 5KB for customer-managed policies, measured in characters. However, the policy presented in the exhibit is very concise, containing only a few lines and basic elements. It is highly improbable that such a small policy would approach or exceed these character limits. A size limit error would only occur with exceptionally large and complex policies, which is clearly not the case here.

Go deeper

TF-004 Understand Terraform basics Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question