A start-up firm is planning to use the Amazon S3 bucket to save all its user data. Resource policy is planned to be applied to these Amazon S3 buckets. To avoid any impact on users, the Operations Head has instructed the team to perform testing of resource policies before applying in production. The Operations Team is using the AWS IAM policy simulator to perform testing on resource policy. While testing, the operations team gets an error message as “Cannot get the resource policy”. 
What checks can be performed to resolve the error message? (Select TWO)

Answer options:

A.Check resource-based policy using AWS IAM Access Analyzer.
B.Check if conditional keys in the policy have the correct values specified.
C.Check if ARN specified for the resource is correct.
D.Check if variables in the policy have correct values specified.
E.Check if the user running simulation has access to retrieve the resource policy.

Correct Answers: C and E
While testing resource-based policy using AWS IAM policy simulator, if there is an error as “Cannot get the resource policy”, the following needs to be checked.
ARN of the resource is correctly mentioned in the policy.
Users running the simulation should have access to the resource policy.
Option A is incorrect as resource-based policy can be tested using the AWS IAM policy simulator. AWS IAM Access Analyzer will help to evaluate resources within AWS which are shared with external entities.
Option B is incorrect as defining incorrect conditional keys in the resource policy will not generate this error message.
Option D is incorrect as defining incorrect variables in the resource policy will not generate this error message.
For more information on AWS IAM, refer to the following URL,
https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html