An organization has launched 5 instances: 2 for production and 3 for testing. The organization
wants that one particular group of IAM users should only access the test instances and not the
production ones. How can the organization set that as a part of the policy?

A.
Launch the test and production instances in separate regions and allow region wise access to
the
group

B.
Define the IAM policy which allows access based on the instance ID

C.
Create an IAM policy with a condition which allows access to only small instances

D.
Define the tags on the test and production servers and add a condition to the IAM policy which
allows
access to specific tags

Explanation:
AWS Identity and Access Management is a web service which allows organizations to manage
users and user permissions for various AWS services. The user can add conditions as a part of
the IAM policies. The condition can be set on AWS Tags, Time, and Client IP as well as on various
parameters. If the organization wants the user to access only specific instances he should define
proper tags and add to the IAM policy condition. The sample policy is shown below.
“Statement”: [
{
“Action”: “ec2:*”,
“Effect”: “Allow”,
“Resource”: “*”,
“Condition”: {
“StringEquals”: {
“ec2:ResourceTag/InstanceType”: “Production”
}}}]