User A is trying to perform the PutItem action on the Amazon DynamoDB table. Sysops Administrator has configured the following conditional IAM policy on the table.
{"Version": "2012-10-17",
"Statement": {
"Effect": "Deny",
"Action": "dynamodb:PutItem",
"Resource": "arn:aws:dynamodb:*:*:table/Thread",
"Condition": {
"ForAnyValue:StringEquals": {
"dynamodb:Attributes": [ "ID", "Tags" ]
}
}
}
}
Which of the following is a correct statement that describes the impact of the above policy on User A?

Answer options:

A.User A request is not denied by the policy when he tries to perform PutItem action in DynamoDB with either user ID or Tags attribute.
B.User A request is not denied by the policy when he tries to perform PutItem action in DynamoDB with just the Tags attribute.
C.User A request is not denied by the policy when he tries to perform PutItem action in DynamoDB with just the user ID attribute.
D.User A request is not denied by the policy when he tries to perform the PutItem action in DynamoDB with just the Username attribute.

Correct Answer: D
Conditions within an IAM policy can be used to specify conditions when a policy is in effect. Multiple key-value pairs can be combined in a condition statement of IAM policy. For a condition statement with ForAnyValue qualifier, if any of the attributes match in the request, then action in the “Effect” element results. In the above IAM policy, Effect is denied, and ForAnyValue qualifier matching any request from user A with a user ID or Tags attribute will result in denying action. Since the Username attribute is not part of the condition, User A with username attribute trying to perform PutItem action on DynamoDB table will not be denied by this IAM policy.
Option A is incorrect. Since the effect is Deny, any attribute with a user ID or Tags used to perform PutItem action on the DynamoDB table will be denied.
Option B is incorrect. Since the condition is ForAnyValue, any attribute matching in the request ID or tag is matched and is denied from performing PutItem action on the DynamoDB table.
Option C is incorrect. Since the condition is ForAnyValue, any attribute matching in the request ID or tag is matched and is denied from performing PutItem action on the DynamoDB table.
For more information on Conditions with AWS IAM policies, refer to the following URL,
https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_multi-value-conditions.html