Exam AWS Certified SysOps Administrator - Associate topic 1 question 285 discussion

Exam question from Amazon's AWS Certified SysOps Administrator - Associate

Question #: 285
Topic #: 1

[All AWS Certified SysOps Administrator - Associate Questions]

A company has an AWS CloudFormation template that creates an Amazon S3 bucket. A user authenticates to the corporate AWS account with their Active Directory credentials and attempts to deploy the CloudFormation template. However, the stack creation fails.

Which factors could cause this failure? (Choose two.)

A. The user’s IAM policy does not allow the cloudformation:CreateStack action.
B. The user’s IAM policy does not allow the cloudformation:CreateStackSet action.
C. The user’s IAM policy does not allow the s3:CreateBucket action.
D. The user’s IAM policy explicitly denies the s3:ListBucket action.
E. The user’s IAM policy explicitly denies the s3:PutObject action.

Show Suggested Answer

Suggested Answer: AC 🗳️

by trvtrinh at July 24, 2023, 1:14 a.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

trvtrinh

Highly Voted 1 year, 4 months ago

Options B, D, and E are not relevant to the CloudFormation stack creation failure for an S3 bucket. Option B is related to CloudFormation StackSets, not individual stacks. Option D and E are related to specific S3 bucket actions (list and put) and are not directly related to the stack creation process. Therefore, the correct answers are A and C.

upvoted 10 times

...

joshnort

Most Recent 8 months, 2 weeks ago

Selected Answer: AC

The failure of the CloudFormation stack creation can be due to several factors related to IAM policies and S3 bucket permissions. Let's go through the options: A. The user’s IAM policy does not allow the cloudformation:CreateStack action. This could definitely cause the stack creation to fail, as the user needs permission to create CloudFormation stacks. B. The user’s IAM policy does not allow the cloudformation:CreateStackSet action. This action is related to stack sets, not individual stacks. Since the question is about stack creation, this is less likely to be the cause of the failure. C. The user’s IAM policy does not allow the s3:CreateBucket action. This is a crucial permission because the CloudFormation template is creating an S3 bucket. If the user doesn't have permission to create S3 buckets, the stack creation will fail.

upvoted 2 times

joshnort

8 months, 2 weeks ago

D. The user’s IAM policy explicitly denies the s3:ListBucket action. While this could cause issues with certain operations on the bucket, it's not directly related to the creation of the bucket itself during the stack creation process. E. The user’s IAM policy explicitly denies the s3:PutObject action. This is related to adding objects to the bucket, not creating the bucket itself during stack creation. So, the two factors that could cause the failure of the stack creation are: A. The user’s IAM policy does not allow the cloudformation:CreateStack action. C. The user’s IAM policy does not allow the s3:CreateBucket action.

upvoted 1 times

...

r2c3po

11 months, 3 weeks ago

Selected Answer: AC

Options B, D, and E are less likely to be directly related to the failure of stack creation: B. The user’s IAM policy does not allow the cloudformation:CreateStackSet action. Stack sets are generally used for deploying stacks across multiple accounts and regions, and it might not be directly related to a stack creation failure in a single account. D. The user’s IAM policy explicitly denies the s3:ListBucket action. While s3:ListBucket is needed for some S3 operations, it's not necessarily required for creating an S3 bucket. E. The user’s IAM policy explicitly denies the s3:PutObject action. Denying s3:PutObject would prevent the user from uploading objects to an existing S3 bucket. It's not a direct factor for creating a new S3 bucket.

upvoted 2 times

...