Amazon AWS Certified Solutions Architect - Associate SAA-C03 Bundle

The option Provide a read-only policy limited to necessary List and Describe actions addresses a separate condition: a role needs to discover resources without managing them. Read discovery can be separated from mutation permissions. The actual requirement is teams require prevention of nonapproved AWS Regions for supported resources. Recommended corrective action: Apply an SCP region guardrail with global-service exemptions. Region controls must avoid blocking globally scoped service APIs.

Ensure applicable SCP deny also covers member-account root principals would help if a root principal tries to use prohibited organization APIs but remains allowed by account permissions. Member-account root is generally subject to SCP constraints. That is not the symptom described here: teams require prevention of nonapproved AWS Regions for supported resources. The matching response is Apply an SCP region guardrail with global-service exemptions, because region controls must avoid blocking globally scoped service APIs.

Use organization-level SCP guardrails against prohibited logging changes solves a different operational problem where a development administrator attempts to disable audit logging in their account. SCP denies block member-account principals notwithstanding local Allow. It does not directly address teams require prevention of nonapproved AWS Regions for supported resources. The case calls for Apply an SCP region guardrail with global-service exemptions, since region controls must avoid blocking globally scoped service APIs.

Review S3 resource policies and Block Public Access separately from IAM roles would help if a bucket is accidentally shared externally despite identity policies being private. Resource policies can create access pathways independent of local identity grants. That is not the symptom described here: privileged access is granted permanently for a weekly maintenance operation. The matching response is Use a time-bounded role or identity-access workflow for the maintenance session, because temporary elevation limits standing privileges.

Inspect effective inherited SCPs and OU path changes solves a different operational problem where a user is blocked after an OU migration although their IAM role did not change. An account OU move changes applicable organization permission boundaries. It does not directly address privileged access is granted permanently for a weekly maintenance operation. The case calls for Use a time-bounded role or identity-access workflow for the maintenance session, since temporary elevation limits standing privileges.

The competing option Validate trust-policy findings with IAM Access Analyzer and narrow principals would be useful when a policy contains a newly introduced wildcard principal in a role trust document. Trust-policy analysis detects broad assumable-role entry points. The present issue is privileged access is granted permanently for a weekly maintenance operation; it is more directly addressed by Use a time-bounded role or identity-access workflow for the maintenance session. Temporary elevation limits standing privileges.

Inspect effective inherited SCPs and OU path changes solves a different operational problem where a user is blocked after an OU migration although their IAM role did not change. An account OU move changes applicable organization permission boundaries. It does not directly address an identity policy repeatedly grants full administrator access to application services. The case calls for Replace broad grants with scoped service-specific roles, since least privilege narrows blast radius from credential compromise.

The competing option Review S3 resource policies and Block Public Access separately from IAM roles would be useful when a bucket is accidentally shared externally despite identity policies being private. Resource policies can create access pathways independent of local identity grants. The present issue is an identity policy repeatedly grants full administrator access to application services; it is more directly addressed by Replace broad grants with scoped service-specific roles. Least privilege narrows blast radius from credential compromise.

The option Validate trust-policy findings with IAM Access Analyzer and narrow principals addresses a separate condition: a policy contains a newly introduced wildcard principal in a role trust document. Trust-policy analysis detects broad assumable-role entry points. The actual requirement is an identity policy repeatedly grants full administrator access to application services. Recommended corrective action: Replace broad grants with scoped service-specific roles. Least privilege narrows blast radius from credential compromise.

The competing option Use a time-bounded role or identity-access workflow for the maintenance session would be useful when privileged access is granted permanently for a weekly maintenance operation. Temporary elevation limits standing privileges. The present issue is a bucket is accidentally shared externally despite identity policies being private; it is more directly addressed by Review S3 resource policies and Block Public Access separately from IAM roles. Resource policies can create access pathways independent of local identity grants.

The option Validate trust-policy findings with IAM Access Analyzer and narrow principals addresses a separate condition: a policy contains a newly introduced wildcard principal in a role trust document. Trust-policy analysis detects broad assumable-role entry points. The actual requirement is a bucket is accidentally shared externally despite identity policies being private. Recommended corrective action: Review S3 resource policies and Block Public Access separately from IAM roles. Resource policies can create access pathways independent of local identity grants.

Replace broad grants with scoped service-specific roles would help if an identity policy repeatedly grants full administrator access to application services. Least privilege narrows blast radius from credential compromise. That is not the symptom described here: a bucket is accidentally shared externally despite identity policies being private. The matching response is Review S3 resource policies and Block Public Access separately from IAM roles, because resource policies can create access pathways independent of local identity grants.

The competing option Replace broad grants with scoped service-specific roles would be useful when an identity policy repeatedly grants full administrator access to application services. Least privilege narrows blast radius from credential compromise. The present issue is a user is blocked after an OU migration although their IAM role did not change; it is more directly addressed by Inspect effective inherited SCPs and OU path changes. An account OU move changes applicable organization permission boundaries.

The option Review S3 resource policies and Block Public Access separately from IAM roles addresses a separate condition: a bucket is accidentally shared externally despite identity policies being private. Resource policies can create access pathways independent of local identity grants. The actual requirement is a user is blocked after an OU migration although their IAM role did not change. Recommended corrective action: Inspect effective inherited SCPs and OU path changes. An account OU move changes applicable organization permission boundaries.

Use a time-bounded role or identity-access workflow for the maintenance session would help if privileged access is granted permanently for a weekly maintenance operation. Temporary elevation limits standing privileges. That is not the symptom described here: a user is blocked after an OU migration although their IAM role did not change. The matching response is Inspect effective inherited SCPs and OU path changes, because an account OU move changes applicable organization permission boundaries.

Replace broad grants with scoped service-specific roles would help if an identity policy repeatedly grants full administrator access to application services. Least privilege narrows blast radius from credential compromise. That is not the symptom described here: a policy contains a newly introduced wildcard principal in a role trust document. The matching response is Validate trust-policy findings with IAM Access Analyzer and narrow principals, because trust-policy analysis detects broad assumable-role entry points.

For the alternative failure a user is blocked after an OU migration although their IAM role did not change, the control Inspect effective inherited SCPs and OU path changes is relevant: an account OU move changes applicable organization permission boundaries. Here the evidence instead is a policy contains a newly introduced wildcard principal in a role trust document. The selected technical mechanism is Validate trust-policy findings with IAM Access Analyzer and narrow principals: trust-policy analysis detects broad assumable-role entry points.

Use a time-bounded role or identity-access workflow for the maintenance session solves a different operational problem where privileged access is granted permanently for a weekly maintenance operation. Temporary elevation limits standing privileges. It does not directly address a policy contains a newly introduced wildcard principal in a role trust document. The case calls for Validate trust-policy findings with IAM Access Analyzer and narrow principals, since trust-policy analysis detects broad assumable-role entry points.

For the alternative failure a departing employee still has working application tokens after IdP disablement, the control Apply session-revocation and token-lifetime controls for the affected application is relevant: identity disablement and existing token expiry have different timing. Here the evidence instead is a new employee should gain access to three accounts based on team membership. The selected technical mechanism is Assign IAM Identity Center permission sets to the relevant account/group pairs: assignment provisioning distributes role access according to approved groups.

Correct the trust policy's SAML federation principal and conditions solves a different operational problem where an IdP-issued federation assertion is rejected because the AWS SAML provider ARN is wrong. SAML role trust requires the configured identity provider and assertion audience. It does not directly address a new employee should gain access to three accounts based on team membership. The case calls for Assign IAM Identity Center permission sets to the relevant account/group pairs, since assignment provisioning distributes role access according to approved groups.

The competing option Configure an IAM OIDC provider and restricted web-identity role trust would be useful when a provider needs an OIDC JWT trusted by AWS STS for a CI build. OIDC audience and subject conditions bound federation trust. The present issue is a new employee should gain access to three accounts based on team membership; it is more directly addressed by Assign IAM Identity Center permission sets to the relevant account/group pairs. Assignment provisioning distributes role access according to approved groups.

Configure an IAM OIDC provider and restricted web-identity role trust solves a different operational problem where a provider needs an OIDC JWT trusted by AWS STS for a CI build. OIDC audience and subject conditions bound federation trust. It does not directly address an IdP-issued federation assertion is rejected because the AWS SAML provider ARN is wrong. The case calls for Correct the trust policy's SAML federation principal and conditions, since sAML role trust requires the configured identity provider and assertion audience.

The competing option Apply session-revocation and token-lifetime controls for the affected application would be useful when a departing employee still has working application tokens after IdP disablement. Identity disablement and existing token expiry have different timing. The present issue is an IdP-issued federation assertion is rejected because the AWS SAML provider ARN is wrong; it is more directly addressed by Correct the trust policy's SAML federation principal and conditions. SAML role trust requires the configured identity provider and assertion audience.

The option Use IAM Roles Anywhere or another supported federation credential exchange addresses a separate condition: a backend invokes an AWS service from a non-AWS host with temporary credentials. Temporary off-AWS workload credentials avoid embedded permanent access keys. The actual requirement is an IdP-issued federation assertion is rejected because the AWS SAML provider ARN is wrong. Recommended corrective action: Correct the trust policy's SAML federation principal and conditions. SAML role trust requires the configured identity provider and assertion audience.

Correct the trust policy's SAML federation principal and conditions solves a different operational problem where an IdP-issued federation assertion is rejected because the AWS SAML provider ARN is wrong. SAML role trust requires the configured identity provider and assertion audience. It does not directly address a backend invokes an AWS service from a non-AWS host with temporary credentials. The case calls for Use IAM Roles Anywhere or another supported federation credential exchange, since temporary off-AWS workload credentials avoid embedded permanent access keys.

The competing option Configure an IAM OIDC provider and restricted web-identity role trust would be useful when a provider needs an OIDC JWT trusted by AWS STS for a CI build. OIDC audience and subject conditions bound federation trust. The present issue is a backend invokes an AWS service from a non-AWS host with temporary credentials; it is more directly addressed by Use IAM Roles Anywhere or another supported federation credential exchange. Temporary off-AWS workload credentials avoid embedded permanent access keys.

Assign IAM Identity Center permission sets to the relevant account/group pairs would help if a new employee should gain access to three accounts based on team membership. Assignment provisioning distributes role access according to approved groups. That is not the symptom described here: a backend invokes an AWS service from a non-AWS host with temporary credentials. The matching response is Use IAM Roles Anywhere or another supported federation credential exchange, because temporary off-AWS workload credentials avoid embedded permanent access keys.

The competing option Correct the trust policy's SAML federation principal and conditions would be useful when an IdP-issued federation assertion is rejected because the AWS SAML provider ARN is wrong. SAML role trust requires the configured identity provider and assertion audience. The present issue is a provider needs an OIDC JWT trusted by AWS STS for a CI build; it is more directly addressed by Configure an IAM OIDC provider and restricted web-identity role trust. OIDC audience and subject conditions bound federation trust.

The option Assign IAM Identity Center permission sets to the relevant account/group pairs addresses a separate condition: a new employee should gain access to three accounts based on team membership. Assignment provisioning distributes role access according to approved groups. The actual requirement is a provider needs an OIDC JWT trusted by AWS STS for a CI build. Recommended corrective action: Configure an IAM OIDC provider and restricted web-identity role trust. OIDC audience and subject conditions bound federation trust.

Apply session-revocation and token-lifetime controls for the affected application would help if a departing employee still has working application tokens after IdP disablement. Identity disablement and existing token expiry have different timing. That is not the symptom described here: a provider needs an OIDC JWT trusted by AWS STS for a CI build. The matching response is Configure an IAM OIDC provider and restricted web-identity role trust, because oIDC audience and subject conditions bound federation trust.

The option Configure an IAM OIDC provider and restricted web-identity role trust addresses a separate condition: a provider needs an OIDC JWT trusted by AWS STS for a CI build. OIDC audience and subject conditions bound federation trust. The actual requirement is a departing employee still has working application tokens after IdP disablement. Recommended corrective action: Apply session-revocation and token-lifetime controls for the affected application. Identity disablement and existing token expiry have different timing.

Assign IAM Identity Center permission sets to the relevant account/group pairs would help if a new employee should gain access to three accounts based on team membership. Assignment provisioning distributes role access according to approved groups. That is not the symptom described here: a departing employee still has working application tokens after IdP disablement. The matching response is Apply session-revocation and token-lifetime controls for the affected application, because identity disablement and existing token expiry have different timing.

For the alternative failure an IdP-issued federation assertion is rejected because the AWS SAML provider ARN is wrong, the control Correct the trust policy's SAML federation principal and conditions is relevant: sAML role trust requires the configured identity provider and assertion audience. Here the evidence instead is a departing employee still has working application tokens after IdP disablement. The selected technical mechanism is Apply session-revocation and token-lifetime controls for the affected application: identity disablement and existing token expiry have different timing.