An ex-employee working with a start-up firm has applied the following policy to IAM users in the Development team. A Junior engineer is looking for permission which will be granted with this policy so that the same policy can be replicated to other users in this team.
Which statement is true concerning permission granted with this policy?
{
"Version": "2012-10-17",
"Statement": [
{ "Effect": "Deny",
"Action": ["cloudtrail:*"],
"NotResource": [
"arn:aws:cloudtrail:us-west-1:111111222222:trail/TEST-TRAIL"]
}
 ]
}

Answer options:

A.Users will be explicitly denied performing any actions on CloudTrail except on Trail with the name as TEST-TRAIL created in the us-west-1 region.
B.Users will be explicitly denied for any actions on CloudTrail.
C.Users will be permitted to perform all actions on CloudTrail except on Trial with the name as TEST-TRAIL created in the us-west-1 region.
D.Only User 111111222222 will be able to perform CloudTrail actions and all other users will be denied performing any actions on CloudTrail.

Correct Answer: A
IAM users and roles do have permission to create or modify CloudTrail resources. AWS IAM Identity-based Policy needs to be created which can be attached to a user or roles giving them permissions to create or modify CloudTrail resources. Above is one of the IAM identity-based policies that denies all actions on CloudTrail resources in an account except for the trail TEST-TRAIL. Users to whom this policy is attached will only be able to modify this trail.
Option B is incorrect as users will be permitted to perform on Trail with the name as TEST-TRAIL.
Option C is incorrect as all users will be permitted to perform all actions only on Trail with the name as TEST-TRAIL.
Option D is incorrect as 111111222222 is an account id and not a user id. All users in account id 111111222222 will be able to perform actions on the CloudTrail trail with the name as TEST-TRAIL.
For more information on AWS CloudTrail Identity-Based Policy, refer to the following URL,
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/security_iam_id-based-policy-examples.html