Explanation:
Explanation: An explicit Deny always overrides an Allow. The first statement grants all EC2 actions, but the second explicitly denies terminate and delete, so those two are blocked.
Ultimate access to all questions.
What is the net effect of the following IAM policy on EC2 actions?
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "ec2:*",
"Resource": "*"
},
{
"Effect": "Deny",
"Action": ["ec2:TerminateInstances", "ec2:DeleteVolume"],
"Resource": "*"
}
]
}
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "ec2:*",
"Resource": "*"
},
{
"Effect": "Deny",
"Action": ["ec2:TerminateInstances", "ec2:DeleteVolume"],
"Resource": "*"
}
]
}
A
No EC2 actions are allowed
B
All EC2 actions are allowed including terminate and delete
C
All EC2 actions are allowed except TerminateInstances and DeleteVolume
D
Only TerminateInstances and DeleteVolume are allowed
No comments yet.