DOP-C02 Practice Question 20: Access Analyzer Pipeline Policy Check
AWS Certified DevOps Engineer – Professional (DOP-C02) · Test 2 · question 10 of 10
Application teams submit CloudFormation templates that include IAM roles with inline identity policies, and a central pipeline deploys them. The security team rules that no such policy may allow iam:PassRole or kms:ScheduleKeyDeletion. The rule must be enforced by a pipeline stage that fails before the stack is deployed. It must evaluate what each policy actually permits, so that wildcards such as iam:* or "Action": "*" are caught just like the literal action names, and the security team does not want to write or maintain its own policy-evaluation logic.
Which pipeline stage meets these requirements?
Show answer and explanation
Answer:
CheckAccessNotGranted is one of the IAM Access Analyzer custom policy checks. You pass a policy document, its type (IDENTITY_POLICY or RESOURCE_POLICY), and an access list of actions and/or resources that must not be allowed. The result is PASS if the policy does not allow any of them, and FAIL if it "might allow some or all" of them, with the reasons pointing to the offending statements. Because the check evaluates what the policy grants rather than its text, a statement with iam:* or "*" fails just like the literal action name. Running it in a build step before the deploy action fails the pipeline before anything reaches the account, and AWS maintains the evaluation logic. Each check is billed per call.
Option A is exactly the string matching the stem rules out. A search for iam:PassRole misses iam:*, iam:Pass*, and "Action": "*", and the team would own the rule's logic.
Option C runs the wrong check. ValidatePolicy checks a policy against IAM policy grammar and AWS best practices and returns errors, security warnings, warnings, and suggestions. It does not take a list of actions you forbid, so it cannot guarantee that these two actions are caught.
Option D enforces at request time, not in the pipeline. An SCP would block the actions when they are called, but the stack would still deploy the non-compliant policies, and the pipeline would never fail before deployment as the rule requires.
References: Validate policies with IAM Access Analyzer custom policy checks; CheckAccessNotGranted; Validate policies with IAM Access Analyzer