Which Actions Does This IAM Policy Allow for a Developer?
Short answer
DE The IAM policy grants elasticloadbalancing:DescribeLoadBalancers and lambda:InvokeFunction, so describing load balancers and invoking Lambda are allowed.
Question
Which actions does this policy allow? (Choose two.)
Key Takeaways
This item tests exact IAM action-to-API matching; the trap is treating service-level mentions in the policy as broad administrative access to that service.
This SOA-C03 question tests whether you can read an IAM policy's Action elements and map them to AWS API calls. It establishes that the policy permits only ELB describe and Lambda invoke operations, making D and E correct.
Common mistake: The most common wrong answer is B: because the policy mentions Lambda in lambda:InvokeFunction, test-takers assume it also permits creating the Lambda execution role, but iam:CreateRole is a separate action that is not listed.
Expert Analysis
Why the Answer Is Correct
The policy's Allow statement includes the ELB describe action family and lambda:InvokeFunction, with no explicit Deny that would override them. Option D maps directly to the ELB describe action, and option E maps directly to the Lambda invoke action within the policy's Resource scope. IAM evaluates only actions that are listed or matched by a wildcard, so these two API calls are permitted. The answer is therefore D and E, not because the services are broadly accessible but because their exact actions appear in the policy.
Why the Other Options Are Wrong
Option A is wrong because creating a Storage Gateway requires storagegateway:CreateGateway, which is absent from the Action list. Option B is wrong because iam:CreateRole is a separate IAM permission; lambda:InvokeFunction only executes an existing function and does not confer role-creation rights. Option C is wrong because deleting an SQS queue requires sqs:DeleteQueue, and no SQS delete action is shown. The policy's service mentions do not create implied permissions, so none of these adjacent operations are allowed.
Community Comment Notes
Bad_Mat's DE pick matches the action-to-option mapping, and the commenter's aside, "Why my comments is disappears all the time?", offers no contradictory technical argument. Because this is a policy-reading item, the exhibit's Action entries are the authority, not the lone vote record. The community note is therefore useful only as a consistency check, and the decisive evidence remains the explicit ELB describe and Lambda invoke permissions.
Official Reference
- https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_action.html
- https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_DescribeLoadBalancers.html
- https://docs.aws.amazon.com/lambda/latest/api/API_Invoke.html
These links open the official vendor documentation in a new tab.
Exam Strategy
Convert each option to its service-prefix API action before matching: Storage Gateway create, IAM CreateRole, SQS DeleteQueue, ELB DescribeLoadBalancers, Lambda InvokeFunction. Then verify only the exact listed actions are allowed, and remember that an explicit Allow does not imply adjacent permissions.
Frequently Asked Questions
Why does lambda:InvokeFunction not allow creating a Lambda execution role?
Does elasticloadbalancing:DescribeLoadBalancers allow deleting a load balancer?
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
Bad_Mat 👍 1Why my comments are disappears all the time?
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SOA-C03 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SOA-C03 Practice Test →