Amazon AWS Certified Solutions Architect - Associate SAA-C03 Bundle

For the alternative failure a contractor keeps access after leaving the corporate directory, the control Remove the contractor from the identity provider and revoke affected sessions where needed is relevant: central identity lifecycle reduces lingering federated access. Here the evidence instead is a root user still signs in with only a password. The selected technical mechanism is Enable root-user MFA and protect recovery factors: the root identity has broad authority and requires a second factor.

Replace shared IAM users with workforce federation through IAM Identity Center solves a different operational problem where teams still use a shared IAM user and password for AWS console administration. Federation provides attributable console identities without sharing a single IAM user password. It does not directly address a root user still signs in with only a password. The case calls for Enable root-user MFA and protect recovery factors, since the root identity has broad authority and requires a second factor.

The competing option Use individual federated identities and correlate CloudTrail principal identities would be useful when engineers cannot identify which person made an administrative change. CloudTrail records the assumed identity behind API activity. The present issue is a root user still signs in with only a password; it is more directly addressed by Enable root-user MFA and protect recovery factors. The root identity has broad authority and requires a second factor.

For the alternative failure a temporary incident responder needs a short bounded administrative session, the control Grant a time-limited assumable role using AWS STS credentials is relevant: sTS issues temporary scoped credentials instead of a permanent shared key. Here the evidence instead is teams still use a shared IAM user and password for AWS console administration. The selected technical mechanism is Replace shared IAM users with workforce federation through IAM Identity Center: federation provides attributable console identities without sharing a single IAM user password.

The competing option Use individual federated identities and correlate CloudTrail principal identities would be useful when engineers cannot identify which person made an administrative change. CloudTrail records the assumed identity behind API activity. The present issue is teams still use a shared IAM user and password for AWS console administration; it is more directly addressed by Replace shared IAM users with workforce federation through IAM Identity Center. Federation provides attributable console identities without sharing a single IAM user password.

The option Remove the contractor from the identity provider and revoke affected sessions where needed addresses a separate condition: a contractor keeps access after leaving the corporate directory. Central identity lifecycle reduces lingering federated access. The actual requirement is teams still use a shared IAM user and password for AWS console administration. Recommended corrective action: Replace shared IAM users with workforce federation through IAM Identity Center. Federation provides attributable console identities without sharing a single IAM user password.

Use individual federated identities and correlate CloudTrail principal identities solves a different operational problem where engineers cannot identify which person made an administrative change. CloudTrail records the assumed identity behind API activity. It does not directly address a contractor keeps access after leaving the corporate directory. The case calls for Remove the contractor from the identity provider and revoke affected sessions where needed, since central identity lifecycle reduces lingering federated access.

The competing option Replace shared IAM users with workforce federation through IAM Identity Center would be useful when teams still use a shared IAM user and password for AWS console administration. Federation provides attributable console identities without sharing a single IAM user password. The present issue is a contractor keeps access after leaving the corporate directory; it is more directly addressed by Remove the contractor from the identity provider and revoke affected sessions where needed. Central identity lifecycle reduces lingering federated access.

The option Grant a time-limited assumable role using AWS STS credentials addresses a separate condition: a temporary incident responder needs a short bounded administrative session. STS issues temporary scoped credentials instead of a permanent shared key. The actual requirement is a contractor keeps access after leaving the corporate directory. Recommended corrective action: Remove the contractor from the identity provider and revoke affected sessions where needed. Central identity lifecycle reduces lingering federated access.

The competing option Remove the contractor from the identity provider and revoke affected sessions where needed would be useful when a contractor keeps access after leaving the corporate directory. Central identity lifecycle reduces lingering federated access. The present issue is a temporary incident responder needs a short bounded administrative session; it is more directly addressed by Grant a time-limited assumable role using AWS STS credentials. STS issues temporary scoped credentials instead of a permanent shared key.

The option Enable root-user MFA and protect recovery factors addresses a separate condition: a root user still signs in with only a password. The root identity has broad authority and requires a second factor. The actual requirement is a temporary incident responder needs a short bounded administrative session. Recommended corrective action: Grant a time-limited assumable role using AWS STS credentials. STS issues temporary scoped credentials instead of a permanent shared key.

For the alternative failure engineers cannot identify which person made an administrative change, the control Use individual federated identities and correlate CloudTrail principal identities is relevant: cloudTrail records the assumed identity behind API activity. Here the evidence instead is a temporary incident responder needs a short bounded administrative session. The selected technical mechanism is Grant a time-limited assumable role using AWS STS credentials: sTS issues temporary scoped credentials instead of a permanent shared key.

Remove the contractor from the identity provider and revoke affected sessions where needed would help if a contractor keeps access after leaving the corporate directory. Central identity lifecycle reduces lingering federated access. That is not the symptom described here: engineers cannot identify which person made an administrative change. The matching response is Use individual federated identities and correlate CloudTrail principal identities, because cloudTrail records the assumed identity behind API activity.

For the alternative failure teams still use a shared IAM user and password for AWS console administration, the control Replace shared IAM users with workforce federation through IAM Identity Center is relevant: federation provides attributable console identities without sharing a single IAM user password. Here the evidence instead is engineers cannot identify which person made an administrative change. The selected technical mechanism is Use individual federated identities and correlate CloudTrail principal identities: cloudTrail records the assumed identity behind API activity.

Enable root-user MFA and protect recovery factors solves a different operational problem where a root user still signs in with only a password. The root identity has broad authority and requires a second factor. It does not directly address engineers cannot identify which person made an administrative change. The case calls for Use individual federated identities and correlate CloudTrail principal identities, since cloudTrail records the assumed identity behind API activity.

Set supported role maximum session duration and request a bounded STS session would help if the partner's sessions must last no longer than one hour. Role session-duration controls limit the validity of assumed credentials. That is not the symptom described here: the vendor cannot assume a role even though the target role has S3 permissions. The matching response is Add the vendor principal to the role trust policy for sts:AssumeRole, because trust policies determine who may assume a role, separate from the role permissions.

For the alternative failure the trust and role policy both allow access but the partner lacks sts:AssumeRole rights, the control Permit sts:AssumeRole in the source principal's effective permissions is relevant: cross-account role assumption needs authorization on both source and target sides. Here the evidence instead is the vendor cannot assume a role even though the target role has S3 permissions. The selected technical mechanism is Add the vendor principal to the role trust policy for sts:AssumeRole: trust policies determine who may assume a role, separate from the role permissions.

The competing option Grant s3:ListBucket on the intended bucket ARN in the role permissions would be useful when the partner assumes a role but cannot list the specified destination bucket. Assuming a role does not create permissions omitted from its identity policy. The present issue is the vendor cannot assume a role even though the target role has S3 permissions; it is more directly addressed by Add the vendor principal to the role trust policy for sts:AssumeRole. Trust policies determine who may assume a role, separate from the role permissions.

For the alternative failure the trust and role policy both allow access but the partner lacks sts:AssumeRole rights, the control Permit sts:AssumeRole in the source principal's effective permissions is relevant: cross-account role assumption needs authorization on both source and target sides. Here the evidence instead is another customer of the same vendor could supply a stolen role ARN. The selected technical mechanism is Require a vendor-specific external ID in the role trust relationship: an external ID mitigates cross-customer confused-deputy role assumption.

Set supported role maximum session duration and request a bounded STS session solves a different operational problem where the partner's sessions must last no longer than one hour. Role session-duration controls limit the validity of assumed credentials. It does not directly address another customer of the same vendor could supply a stolen role ARN. The case calls for Require a vendor-specific external ID in the role trust relationship, since an external ID mitigates cross-customer confused-deputy role assumption.

The competing option Add the vendor principal to the role trust policy for sts:AssumeRole would be useful when the vendor cannot assume a role even though the target role has S3 permissions. Trust policies determine who may assume a role, separate from the role permissions. The present issue is another customer of the same vendor could supply a stolen role ARN; it is more directly addressed by Require a vendor-specific external ID in the role trust relationship. An external ID mitigates cross-customer confused-deputy role assumption.

Add the vendor principal to the role trust policy for sts:AssumeRole solves a different operational problem where the vendor cannot assume a role even though the target role has S3 permissions. Trust policies determine who may assume a role, separate from the role permissions. It does not directly address the partner assumes a role but cannot list the specified destination bucket. The case calls for Grant s3:ListBucket on the intended bucket ARN in the role permissions, since assuming a role does not create permissions omitted from its identity policy.

The option Permit sts:AssumeRole in the source principal's effective permissions addresses a separate condition: the trust and role policy both allow access but the partner lacks sts:AssumeRole rights. Cross-account role assumption needs authorization on both source and target sides. The actual requirement is the partner assumes a role but cannot list the specified destination bucket. Recommended corrective action: Grant s3:ListBucket on the intended bucket ARN in the role permissions. Assuming a role does not create permissions omitted from its identity policy.

Set supported role maximum session duration and request a bounded STS session would help if the partner's sessions must last no longer than one hour. Role session-duration controls limit the validity of assumed credentials. That is not the symptom described here: the partner assumes a role but cannot list the specified destination bucket. The matching response is Grant s3:ListBucket on the intended bucket ARN in the role permissions, because assuming a role does not create permissions omitted from its identity policy.

The competing option Set supported role maximum session duration and request a bounded STS session would be useful when the partner's sessions must last no longer than one hour. Role session-duration controls limit the validity of assumed credentials. The present issue is the trust and role policy both allow access but the partner lacks sts:AssumeRole rights; it is more directly addressed by Permit sts:AssumeRole in the source principal's effective permissions. Cross-account role assumption needs authorization on both source and target sides.

Add the vendor principal to the role trust policy for sts:AssumeRole would help if the vendor cannot assume a role even though the target role has S3 permissions. Trust policies determine who may assume a role, separate from the role permissions. That is not the symptom described here: the trust and role policy both allow access but the partner lacks sts:AssumeRole rights. The matching response is Permit sts:AssumeRole in the source principal's effective permissions, because cross-account role assumption needs authorization on both source and target sides.

For the alternative failure another customer of the same vendor could supply a stolen role ARN, the control Require a vendor-specific external ID in the role trust relationship is relevant: an external ID mitigates cross-customer confused-deputy role assumption. Here the evidence instead is the trust and role policy both allow access but the partner lacks sts:AssumeRole rights. The selected technical mechanism is Permit sts:AssumeRole in the source principal's effective permissions: cross-account role assumption needs authorization on both source and target sides.

The option Require a vendor-specific external ID in the role trust relationship addresses a separate condition: another customer of the same vendor could supply a stolen role ARN. An external ID mitigates cross-customer confused-deputy role assumption. The actual requirement is the partner's sessions must last no longer than one hour. Recommended corrective action: Set supported role maximum session duration and request a bounded STS session. Role session-duration controls limit the validity of assumed credentials.

Add the vendor principal to the role trust policy for sts:AssumeRole would help if the vendor cannot assume a role even though the target role has S3 permissions. Trust policies determine who may assume a role, separate from the role permissions. That is not the symptom described here: the partner's sessions must last no longer than one hour. The matching response is Set supported role maximum session duration and request a bounded STS session, because role session-duration controls limit the validity of assumed credentials.

For the alternative failure the partner assumes a role but cannot list the specified destination bucket, the control Grant s3:ListBucket on the intended bucket ARN in the role permissions is relevant: assuming a role does not create permissions omitted from its identity policy. Here the evidence instead is the partner's sessions must last no longer than one hour. The selected technical mechanism is Set supported role maximum session duration and request a bounded STS session: role session-duration controls limit the validity of assumed credentials.