[Solved] Given this IAM policy snippet:{"Effect": "Deny", "Action": "ec2:StartInstances", "Resource": "*"}What will happen if a user tries to start any EC2 instance? | AWS

AWS - Identity and Access Management

Given this IAM policy snippet:

{"Effect": "Deny", "Action": "ec2:StartInstances", "Resource": "*"}

What will happen if a user tries to start any EC2 instance?

AThe user will be denied permission to start any EC2 instance

BThe user will be allowed to start EC2 instances

CThe policy will cause a syntax error and not apply

DThe user can start instances only in specific regions

Step-by-Step Solution

Solution:

Step 1: Understand the "Effect" and "Action" in the policy
The "Effect" is "Deny" for the action "ec2:StartInstances" on all resources ("*").
Step 2: Interpret the policy effect on user actions
This means the user is explicitly denied permission to start any EC2 instance regardless of other policies.
Final Answer:
User is denied permission to start EC2 instances -> Option A
Quick Check:
Effect Deny + Action = Deny action [OK]

Quick Trick: "Deny" always blocks the specified action regardless of other policies [OK]

Common Mistakes:

Master "Identity and Access Management" in AWS

9 interactive learning modes - each teaches the same concept differently

More AWS Quizzes

Given this IAM policy snippet: