AWS Certified Solutions Architect – Professional — Question 102

An AWS account owner has setup multiple IAM users. One of these IAM users, named John, has CloudWatch access, but no access to EC2 services. John has setup an alarm action which stops EC2 instances when their CPU utilization is below the threshold limit.
When an EC2 instance's CPU Utilization rate drops below the threshold John has set, what will happen and why?

Answer options

• A. CloudWatch will stop the instance when the action is executed
• B. Nothing will happen. John cannot set an alarm on EC2 since he does not have the permission.
• C. Nothing will happen. John can setup the action, but it will not be executed because he does not have EC2 access through IAM policies.
• D. Nothing will happen because it is not possible to stop the instance using the CloudWatch alarm

Correct answer: C

Explanation

The correct answer is C because John, despite being able to create the alarm, lacks the necessary permissions to execute actions on EC2 instances due to his IAM policy restrictions. Answers A and B are incorrect as they misunderstand the relationship between alarm configuration and permissions, while D is wrong because CloudWatch can indeed trigger actions, but John's lack of EC2 access prevents execution.