Amazon AWS Certified Solutions Architect - Associate SAA-C03 Bundle

The option Require a vendor-specific external ID in the role trust relationship addresses a separate condition: another customer of the same vendor could supply a stolen role ARN. An external ID mitigates cross-customer confused-deputy role assumption. The actual requirement is the partner's sessions must last no longer than one hour. Recommended corrective action: Set supported role maximum session duration and request a bounded STS session. Role session-duration controls limit the validity of assumed credentials.

Add the vendor principal to the role trust policy for sts:AssumeRole would help if the vendor cannot assume a role even though the target role has S3 permissions. Trust policies determine who may assume a role, separate from the role permissions. That is not the symptom described here: the partner's sessions must last no longer than one hour. The matching response is Set supported role maximum session duration and request a bounded STS session, because role session-duration controls limit the validity of assumed credentials.

For the alternative failure the partner assumes a role but cannot list the specified destination bucket, the control Grant s3:ListBucket on the intended bucket ARN in the role permissions is relevant: assuming a role does not create permissions omitted from its identity policy. Here the evidence instead is the partner's sessions must last no longer than one hour. The selected technical mechanism is Set supported role maximum session duration and request a bounded STS session: role session-duration controls limit the validity of assumed credentials.

Attach the focused SCP to the intended organizational unit would help if a restriction must apply to one organizational unit without affecting sibling units. Organizational-unit attachment scopes inherited preventive restrictions. That is not the symptom described here: an account administrator bypasses a local IAM deny by adding a new administrator policy. The matching response is Apply an explicit SCP deny for the prohibited organizational action, because an SCP caps account-principal permissions regardless of local policy grants.

For the alternative failure a service-linked role is expected to be restricted by the same account SCP, the control Account for SCP exclusions for service-linked roles in the guardrail design is relevant: sCPs do not restrict service-linked roles in the same way as IAM principals. Here the evidence instead is an account administrator bypasses a local IAM deny by adding a new administrator policy. The selected technical mechanism is Apply an explicit SCP deny for the prohibited organizational action: an SCP caps account-principal permissions regardless of local policy grants.

Use AWS Config rules or conformance packs for detective compliance checks solves a different operational problem where the organization requires evidence that configuration drifts after deployment. Config evaluates resource state rather than merely preventing API actions. It does not directly address an account administrator bypasses a local IAM deny by adding a new administrator policy. The case calls for Apply an explicit SCP deny for the prohibited organizational action, since an SCP caps account-principal permissions regardless of local policy grants.

For the alternative failure a permission request is rejected even though an IAM policy allows it, the control Examine the effective SCPs inherited from the root and organizational units is relevant: sCPs constrain identity permission evaluation across the hierarchy. Here the evidence instead is a service-linked role is expected to be restricted by the same account SCP. The selected technical mechanism is Account for SCP exclusions for service-linked roles in the guardrail design: sCPs do not restrict service-linked roles in the same way as IAM principals.

Use AWS Config rules or conformance packs for detective compliance checks solves a different operational problem where the organization requires evidence that configuration drifts after deployment. Config evaluates resource state rather than merely preventing API actions. It does not directly address a service-linked role is expected to be restricted by the same account SCP. The case calls for Account for SCP exclusions for service-linked roles in the guardrail design, since sCPs do not restrict service-linked roles in the same way as IAM principals.

The option Apply an explicit SCP deny for the prohibited organizational action addresses a separate condition: an account administrator bypasses a local IAM deny by adding a new administrator policy. An SCP caps account-principal permissions regardless of local policy grants. The actual requirement is a service-linked role is expected to be restricted by the same account SCP. Recommended corrective action: Account for SCP exclusions for service-linked roles in the guardrail design. SCPs do not restrict service-linked roles in the same way as IAM principals.

Account for SCP exclusions for service-linked roles in the guardrail design solves a different operational problem where a service-linked role is expected to be restricted by the same account SCP. SCPs do not restrict service-linked roles in the same way as IAM principals. It does not directly address a permission request is rejected even though an IAM policy allows it. The case calls for Examine the effective SCPs inherited from the root and organizational units, since sCPs constrain identity permission evaluation across the hierarchy.

The option Attach the focused SCP to the intended organizational unit addresses a separate condition: a restriction must apply to one organizational unit without affecting sibling units. Organizational-unit attachment scopes inherited preventive restrictions. The actual requirement is a permission request is rejected even though an IAM policy allows it. Recommended corrective action: Examine the effective SCPs inherited from the root and organizational units. SCPs constrain identity permission evaluation across the hierarchy.

Apply an explicit SCP deny for the prohibited organizational action would help if an account administrator bypasses a local IAM deny by adding a new administrator policy. An SCP caps account-principal permissions regardless of local policy grants. That is not the symptom described here: a permission request is rejected even though an IAM policy allows it. The matching response is Examine the effective SCPs inherited from the root and organizational units, because sCPs constrain identity permission evaluation across the hierarchy.

The option Account for SCP exclusions for service-linked roles in the guardrail design addresses a separate condition: a service-linked role is expected to be restricted by the same account SCP. SCPs do not restrict service-linked roles in the same way as IAM principals. The actual requirement is a restriction must apply to one organizational unit without affecting sibling units. Recommended corrective action: Attach the focused SCP to the intended organizational unit. Organizational-unit attachment scopes inherited preventive restrictions.

Apply an explicit SCP deny for the prohibited organizational action would help if an account administrator bypasses a local IAM deny by adding a new administrator policy. An SCP caps account-principal permissions regardless of local policy grants. That is not the symptom described here: a restriction must apply to one organizational unit without affecting sibling units. The matching response is Attach the focused SCP to the intended organizational unit, because organizational-unit attachment scopes inherited preventive restrictions.

For the alternative failure a permission request is rejected even though an IAM policy allows it, the control Examine the effective SCPs inherited from the root and organizational units is relevant: sCPs constrain identity permission evaluation across the hierarchy. Here the evidence instead is a restriction must apply to one organizational unit without affecting sibling units. The selected technical mechanism is Attach the focused SCP to the intended organizational unit: organizational-unit attachment scopes inherited preventive restrictions.

Apply an explicit SCP deny for the prohibited organizational action would help if an account administrator bypasses a local IAM deny by adding a new administrator policy. An SCP caps account-principal permissions regardless of local policy grants. That is not the symptom described here: the organization requires evidence that configuration drifts after deployment. The matching response is Use AWS Config rules or conformance packs for detective compliance checks, because config evaluates resource state rather than merely preventing API actions.

For the alternative failure a service-linked role is expected to be restricted by the same account SCP, the control Account for SCP exclusions for service-linked roles in the guardrail design is relevant: sCPs do not restrict service-linked roles in the same way as IAM principals. Here the evidence instead is the organization requires evidence that configuration drifts after deployment. The selected technical mechanism is Use AWS Config rules or conformance packs for detective compliance checks: config evaluates resource state rather than merely preventing API actions.

Attach the focused SCP to the intended organizational unit solves a different operational problem where a restriction must apply to one organizational unit without affecting sibling units. Organizational-unit attachment scopes inherited preventive restrictions. It does not directly address the organization requires evidence that configuration drifts after deployment. The case calls for Use AWS Config rules or conformance packs for detective compliance checks, since config evaluates resource state rather than merely preventing API actions.

Require a permissions boundary on IAM roles created by that developer would help if a developer is allowed to create roles but may attach broader permissions than approved. A boundary limits the maximum permissions of newly created roles. That is not the symptom described here: a broad wildcard policy lets a role delete resources outside its support scope. The matching response is Replace wildcard permissions with exact actions and resource ARNs, because narrow action and resource scopes enforce least privilege.

For the alternative failure a human operator must perform reads but not writes on tagged staging resources, the control Use supported IAM condition keys to constrain requested operations and resource tags is relevant: IAM conditions can restrict requests beyond action and resource lists. Here the evidence instead is a broad wildcard policy lets a role delete resources outside its support scope. The selected technical mechanism is Replace wildcard permissions with exact actions and resource ARNs: narrow action and resource scopes enforce least privilege.

The competing option Update the boundary only after approving the needed operation would be useful when a role has identity-policy Allow but a permissions boundary excludes the operation. The effective permission intersection cannot exceed the boundary. The present issue is a broad wildcard policy lets a role delete resources outside its support scope; it is more directly addressed by Replace wildcard permissions with exact actions and resource ARNs. Narrow action and resource scopes enforce least privilege.

For the alternative failure a developer is allowed to create roles but may attach broader permissions than approved, the control Require a permissions boundary on IAM roles created by that developer is relevant: a boundary limits the maximum permissions of newly created roles. Here the evidence instead is a human operator must perform reads but not writes on tagged staging resources. The selected technical mechanism is Use supported IAM condition keys to constrain requested operations and resource tags: IAM conditions can restrict requests beyond action and resource lists.

The competing option Evaluate the proposed request using IAM policy simulation and policy review would be useful when a policy change must be tested before rollout without executing destructive APIs. Simulation exposes expected allow and deny decisions without the real operation. The present issue is a human operator must perform reads but not writes on tagged staging resources; it is more directly addressed by Use supported IAM condition keys to constrain requested operations and resource tags. IAM conditions can restrict requests beyond action and resource lists.

The option Replace wildcard permissions with exact actions and resource ARNs addresses a separate condition: a broad wildcard policy lets a role delete resources outside its support scope. Narrow action and resource scopes enforce least privilege. The actual requirement is a human operator must perform reads but not writes on tagged staging resources. Recommended corrective action: Use supported IAM condition keys to constrain requested operations and resource tags. IAM conditions can restrict requests beyond action and resource lists.

The competing option Require a permissions boundary on IAM roles created by that developer would be useful when a developer is allowed to create roles but may attach broader permissions than approved. A boundary limits the maximum permissions of newly created roles. The present issue is a role has identity-policy Allow but a permissions boundary excludes the operation; it is more directly addressed by Update the boundary only after approving the needed operation. The effective permission intersection cannot exceed the boundary.

The option Evaluate the proposed request using IAM policy simulation and policy review addresses a separate condition: a policy change must be tested before rollout without executing destructive APIs. Simulation exposes expected allow and deny decisions without the real operation. The actual requirement is a role has identity-policy Allow but a permissions boundary excludes the operation. Recommended corrective action: Update the boundary only after approving the needed operation. The effective permission intersection cannot exceed the boundary.

Use supported IAM condition keys to constrain requested operations and resource tags would help if a human operator must perform reads but not writes on tagged staging resources. IAM conditions can restrict requests beyond action and resource lists. That is not the symptom described here: a role has identity-policy Allow but a permissions boundary excludes the operation. The matching response is Update the boundary only after approving the needed operation, because the effective permission intersection cannot exceed the boundary.

The competing option Use supported IAM condition keys to constrain requested operations and resource tags would be useful when a human operator must perform reads but not writes on tagged staging resources. IAM conditions can restrict requests beyond action and resource lists. The present issue is a developer is allowed to create roles but may attach broader permissions than approved; it is more directly addressed by Require a permissions boundary on IAM roles created by that developer. A boundary limits the maximum permissions of newly created roles.

The option Evaluate the proposed request using IAM policy simulation and policy review addresses a separate condition: a policy change must be tested before rollout without executing destructive APIs. Simulation exposes expected allow and deny decisions without the real operation. The actual requirement is a developer is allowed to create roles but may attach broader permissions than approved. Recommended corrective action: Require a permissions boundary on IAM roles created by that developer. A boundary limits the maximum permissions of newly created roles.

Update the boundary only after approving the needed operation would help if a role has identity-policy Allow but a permissions boundary excludes the operation. The effective permission intersection cannot exceed the boundary. That is not the symptom described here: a developer is allowed to create roles but may attach broader permissions than approved. The matching response is Require a permissions boundary on IAM roles created by that developer, because a boundary limits the maximum permissions of newly created roles.

The option Use supported IAM condition keys to constrain requested operations and resource tags addresses a separate condition: a human operator must perform reads but not writes on tagged staging resources. IAM conditions can restrict requests beyond action and resource lists. The actual requirement is a policy change must be tested before rollout without executing destructive APIs. Recommended corrective action: Evaluate the proposed request using IAM policy simulation and policy review. Simulation exposes expected allow and deny decisions without the real operation.

Replace wildcard permissions with exact actions and resource ARNs would help if a broad wildcard policy lets a role delete resources outside its support scope. Narrow action and resource scopes enforce least privilege. That is not the symptom described here: a policy change must be tested before rollout without executing destructive APIs. The matching response is Evaluate the proposed request using IAM policy simulation and policy review, because simulation exposes expected allow and deny decisions without the real operation.

Require a permissions boundary on IAM roles created by that developer solves a different operational problem where a developer is allowed to create roles but may attach broader permissions than approved. A boundary limits the maximum permissions of newly created roles. It does not directly address a policy change must be tested before rollout without executing destructive APIs. The case calls for Evaluate the proposed request using IAM policy simulation and policy review, since simulation exposes expected allow and deny decisions without the real operation.