A company is reviewing its IAM policies. One policy written by the DevOps engineer has been flagged as too permissive. The policy is used by an AWS Lambda function that issues a stop command to Amazon EC2 instances tagged with Environment: NonProduction over the weekend. The current policy is:
 
What changes should the engineer make to achieve a policy of least permission? (Choose three.)

A. Add the following conditional expression:
      

B. Change "Resource": "*"to "Resource": "arn:aws:ec2:*:*:instance/*"

C. Add the following conditional expression:
      

D. Add the following conditional expression:
      

E. Change "Action": "ec2:*"to "Action": "ec2:StopInstances"

F. Add the following conditional expression:
      




 

Suggested Answer: C

Community Answer: B




This question is in DOP-C02 AWS Certified DevOps Engineer – Professional Exam
For getting AWS Certified DevOps Engineer – Professional Certificate


Disclaimers:
The website is not related to, affiliated with, endorsed or authorized by Amazon.
Trademarks, certification & product names are used for reference only and belong to Amazon.
The website does not contain actual questions and answers from Amazon's Certification Exam.