You want to create a policy that allows ec2:StopInstances only during business hours (9 AM to 5 PM UTC) and denies it otherwise. Which policy logic correctly enforces this?
hard📝 Best Practice Q15 of 15
AWS - Identity and Access Management
You want to create a policy that allows ec2:StopInstances only during business hours (9 AM to 5 PM UTC) and denies it otherwise. Which policy logic correctly enforces this?
AOnly use Deny with condition outside 9-17 UTC, no Allow needed.
BAllow <code>ec2:StopInstances</code> with condition <code>"DateGreaterThan": {"aws:CurrentTime": "09:00:00Z"}</code>, no Deny needed.
CAllow <code>ec2:StopInstances</code> unconditionally, and add a Deny with condition outside 9-17 UTC.
DAllow <code>ec2:StopInstances</code> with condition for 9-17 UTC, and Deny unconditionally.
Step-by-Step Solution
Solution:
Step 1: Understand Deny override with time condition
Unconditional Allow permits ec2:StopInstances, but explicit Deny applies outside 9-17 UTC overriding the Allow.
