Developers should be able to manage only the EC2 instances tagged with their own department. Which condition setup expresses that?
Show answer and explanation
Answer: C
The condition compares two values instead of a literal: the caller department tag from aws:PrincipalTag/Department must equal the instance department tag from aws:ResourceTag/Department. One statement then covers every department, because each developer is matched to instances carrying the same tag value.
Tagging the principal and the resource consistently is the operational requirement that makes it work.
Why the other options are wrong
- A. Comparing the principal tag with the request tag only validates what the caller supplied in the call, not the tag on the target instance.
- B. A fixed literal would allow a single department and require a separate statement for every other one.
- D. Resource tag alone says nothing about the caller, so any user could act on a tagged instance.
Exam tip. ABAC match: aws:PrincipalTag/Key equals aws:ResourceTag/Key.