Tag: Question 338

AWS Certified Advanced Networking – Specialty ANS-C00 – Question338

An AWS account owner has setup multiple IAM users. One of these IAM users, named John, has CloudWatch access, but no access to EC2 services. John has setup an alarm action which stops EC2 instances when their CPU utilization is below the threshold limit. When an EC2 instance's CPU Utilization rate drops below the threshold John has set, what will happen and why?

A. Nothing will happen. John cannot set an alarm on EC2 since he does not have the permission.
B. CloudWatch will stop the instance when the action is executed
C. Nothing will happen because it is not possible to stop the instance using the CloudWatch alarm
D. Nothing will happen. John can setup the action, but it will not be executed because he does not have EC2 access through IAM policies.

Correct Answer: D

Explanation:

Explanation: Amazon CloudWatch alarms watch a single metric over a time period that the user specifies and performs one or more actions based on the value of the metric relative to a given threshold over a number of time periods. The user can setup an action which stops the instances when their CPU utilization is below a certain threshold for a certain period of time. The EC2 action can either terminate or stop the instance as part of the EC2 action. If the IAM user has read/write permissions for Amazon CloudWatch but not for Amazon EC2, he can still create an alarm. However, the stop or terminate actions will not be performed on the Amazon EC2 instance.
Reference: http://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/UsingAlarmActions.html