SAA-C03 Q132 · IAM

Question

A company uses Amazon EC2 instances to host its internal systems. As part of a deployment operation, an administrator tries to use the AWS CLI to terminate an EC2 instance. However, the administrator receives a 403 (Access Denied) error message. The administrator is using an IAM role that has the following IAM policy attached: What is the cause of the unsuccessful request?

Accepted Answer

**Answer D: The request does not originate from the allowed CIDR blocks.**

The IAM policy attached to the role likely contains an Allow statement for EC2 actions, but with a **Condition** element that restricts access based on `aws:SourceIp`. The condition requires that requests must originate from either `192.0.2.0/24` or `203.0.113.0/24`.

Here's the step-by-step reasoning:

1. **The policy grants ec2:* actions** — so the Action field is not the issue.
2. **The policy has an Allow effect** — so there's no explicit Deny.
3. **The Condition block uses `aws:SourceIp`** — this restricts where API calls can originate from.
4. **The administrator's IP address is NOT within the allowed CIDR ranges** — when a Condition evaluates to `false`, the Allow statement does not apply.
5. **Without the A

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

⚙️ Operations

🔒 Security

🎯 Exam Tips