An organization has launched 5 instances: 2 for production and 3 for testing. The organization wants that one
particular group of IAM users should only access the test instances and not the production ones. How can the
organization set that as a part of the policy?

A.
Launch the test and production instances in separate regions and allow region wise access to the group

B.
Define the IAM policy which allows access based on the instance ID

C.
Create an IAM policy with a condition which allows access to only small instances

D.
Define the tags on the test and production servers and add a condition to the IAM policy which allows
access to specific tags

Explanation:
AWS Identity and Access Management is a web service which allows organizations to manage users and user
permissions for various AWS services. The user can add conditions as a part of the IAM policies. The
condition can be set on AWS Tags, Time, and Client IP as well as on various parameters. If the organization
wants the user to access only specific instances he should define proper tags and add to the IAM policy
condition. The sample policy is shown below.