Amazon AWS Certified Solutions Architect - Associate SAA-C03 Bundle

The option Use supported IAM condition keys to constrain requested operations and resource tags addresses a separate condition: a human operator must perform reads but not writes on tagged staging resources. IAM conditions can restrict requests beyond action and resource lists. The actual requirement is a policy change must be tested before rollout without executing destructive APIs. Recommended corrective action: Evaluate the proposed request using IAM policy simulation and policy review. Simulation exposes expected allow and deny decisions without the real operation.

Replace wildcard permissions with exact actions and resource ARNs would help if a broad wildcard policy lets a role delete resources outside its support scope. Narrow action and resource scopes enforce least privilege. That is not the symptom described here: a policy change must be tested before rollout without executing destructive APIs. The matching response is Evaluate the proposed request using IAM policy simulation and policy review, because simulation exposes expected allow and deny decisions without the real operation.

Require a permissions boundary on IAM roles created by that developer solves a different operational problem where a developer is allowed to create roles but may attach broader permissions than approved. A boundary limits the maximum permissions of newly created roles. It does not directly address a policy change must be tested before rollout without executing destructive APIs. The case calls for Evaluate the proposed request using IAM policy simulation and policy review, since simulation exposes expected allow and deny decisions without the real operation.

Use CloudFront origin access control with a narrowly scoped bucket policy would help if a public website is meant to use CloudFront but the origin bucket allows direct access. OAC authorizes CloudFront origin requests while keeping bucket access private. That is not the symptom described here: a bucket permits anonymous object reads via a permissive resource policy. The matching response is Enable S3 Block Public Access and remove the public bucket-policy statement, because public access blocking and restrictive policy jointly prevent anonymous reads.

Create a scoped bucket access point policy for the intended prefix and principal solves a different operational problem where a consumer account needs read access to only one prefix of a shared bucket. Access points provide separately scoped S3 access controls. It does not directly address a bucket permits anonymous object reads via a permissive resource policy. The case calls for Enable S3 Block Public Access and remove the public bucket-policy statement, since public access blocking and restrictive policy jointly prevent anonymous reads.

The competing option Permit the consumer in both S3 access policy and customer-managed KMS key policy would be useful when an external account reads a bucket encrypted with SSE-KMS but gets AccessDenied. KMS authorization is separate from object access for SSE-KMS data. The present issue is a bucket permits anonymous object reads via a permissive resource policy; it is more directly addressed by Enable S3 Block Public Access and remove the public bucket-policy statement. Public access blocking and restrictive policy jointly prevent anonymous reads.

For the alternative failure an external account reads a bucket encrypted with SSE-KMS but gets AccessDenied, the control Permit the consumer in both S3 access policy and customer-managed KMS key policy is relevant: kMS authorization is separate from object access for SSE-KMS data. Here the evidence instead is a consumer account needs read access to only one prefix of a shared bucket. The selected technical mechanism is Create a scoped bucket access point policy for the intended prefix and principal: access points provide separately scoped S3 access controls.

Migrate callers from object ACLs to policy-based permissions before enabling ACL-disabled ownership solves a different operational problem where an owner-enforced bucket still has clients relying on historical object ACL grants. ACL-disabled bucket ownership requires callers to stop depending on object ACLs. It does not directly address a consumer account needs read access to only one prefix of a shared bucket. The case calls for Create a scoped bucket access point policy for the intended prefix and principal, since access points provide separately scoped S3 access controls.

The competing option Enable S3 Block Public Access and remove the public bucket-policy statement would be useful when a bucket permits anonymous object reads via a permissive resource policy. Public access blocking and restrictive policy jointly prevent anonymous reads. The present issue is a consumer account needs read access to only one prefix of a shared bucket; it is more directly addressed by Create a scoped bucket access point policy for the intended prefix and principal. Access points provide separately scoped S3 access controls.

The competing option Enable S3 Block Public Access and remove the public bucket-policy statement would be useful when a bucket permits anonymous object reads via a permissive resource policy. Public access blocking and restrictive policy jointly prevent anonymous reads. The present issue is a public website is meant to use CloudFront but the origin bucket allows direct access; it is more directly addressed by Use CloudFront origin access control with a narrowly scoped bucket policy. OAC authorizes CloudFront origin requests while keeping bucket access private.

The option Permit the consumer in both S3 access policy and customer-managed KMS key policy addresses a separate condition: an external account reads a bucket encrypted with SSE-KMS but gets AccessDenied. KMS authorization is separate from object access for SSE-KMS data. The actual requirement is a public website is meant to use CloudFront but the origin bucket allows direct access. Recommended corrective action: Use CloudFront origin access control with a narrowly scoped bucket policy. OAC authorizes CloudFront origin requests while keeping bucket access private.

Create a scoped bucket access point policy for the intended prefix and principal would help if a consumer account needs read access to only one prefix of a shared bucket. Access points provide separately scoped S3 access controls. That is not the symptom described here: a public website is meant to use CloudFront but the origin bucket allows direct access. The matching response is Use CloudFront origin access control with a narrowly scoped bucket policy, because oAC authorizes CloudFront origin requests while keeping bucket access private.

The competing option Enable S3 Block Public Access and remove the public bucket-policy statement would be useful when a bucket permits anonymous object reads via a permissive resource policy. Public access blocking and restrictive policy jointly prevent anonymous reads. The present issue is an owner-enforced bucket still has clients relying on historical object ACL grants; it is more directly addressed by Migrate callers from object ACLs to policy-based permissions before enabling ACL-disabled ownership. ACL-disabled bucket ownership requires callers to stop depending on object ACLs.

Create a scoped bucket access point policy for the intended prefix and principal would help if a consumer account needs read access to only one prefix of a shared bucket. Access points provide separately scoped S3 access controls. That is not the symptom described here: an owner-enforced bucket still has clients relying on historical object ACL grants. The matching response is Migrate callers from object ACLs to policy-based permissions before enabling ACL-disabled ownership, because aCL-disabled bucket ownership requires callers to stop depending on object ACLs.

For the alternative failure an external account reads a bucket encrypted with SSE-KMS but gets AccessDenied, the control Permit the consumer in both S3 access policy and customer-managed KMS key policy is relevant: kMS authorization is separate from object access for SSE-KMS data. Here the evidence instead is an owner-enforced bucket still has clients relying on historical object ACL grants. The selected technical mechanism is Migrate callers from object ACLs to policy-based permissions before enabling ACL-disabled ownership: aCL-disabled bucket ownership requires callers to stop depending on object ACLs.

Create a scoped bucket access point policy for the intended prefix and principal would help if a consumer account needs read access to only one prefix of a shared bucket. Access points provide separately scoped S3 access controls. That is not the symptom described here: an external account reads a bucket encrypted with SSE-KMS but gets AccessDenied. The matching response is Permit the consumer in both S3 access policy and customer-managed KMS key policy, because kMS authorization is separate from object access for SSE-KMS data.

For the alternative failure a bucket permits anonymous object reads via a permissive resource policy, the control Enable S3 Block Public Access and remove the public bucket-policy statement is relevant: public access blocking and restrictive policy jointly prevent anonymous reads. Here the evidence instead is an external account reads a bucket encrypted with SSE-KMS but gets AccessDenied. The selected technical mechanism is Permit the consumer in both S3 access policy and customer-managed KMS key policy: kMS authorization is separate from object access for SSE-KMS data.

Use CloudFront origin access control with a narrowly scoped bucket policy solves a different operational problem where a public website is meant to use CloudFront but the origin bucket allows direct access. OAC authorizes CloudFront origin requests while keeping bucket access private. It does not directly address an external account reads a bucket encrypted with SSE-KMS but gets AccessDenied. The case calls for Permit the consumer in both S3 access policy and customer-managed KMS key policy, since kMS authorization is separate from object access for SSE-KMS data.

Inspect IAM Access Analyzer external-access findings and the affected resource policy would help if a role policy has a finding for access to external AWS accounts. Access Analyzer detects resource sharing outside the defined trust zone. That is not the symptom described here: a policy grants access to resources never used by the role. The matching response is Use IAM Access Analyzer policy generation and last-accessed evidence to tighten grants, because access evidence helps identify unused permissions.

For the alternative failure a developer needs a deploy-time service role but should not create arbitrary privileged roles, the control Restrict iam:PassRole to approved target role ARNs and compatible services is relevant: passRole permission controls which role a principal may delegate to a service. Here the evidence instead is a policy grants access to resources never used by the role. The selected technical mechanism is Use IAM Access Analyzer policy generation and last-accessed evidence to tighten grants: access evidence helps identify unused permissions.

The competing option Enable organization CloudTrail events and analyze AssumeRole activity would be useful when the architecture needs a central log of every role assumption by an operator. CloudTrail captures STS calls and their requester context. The present issue is a policy grants access to resources never used by the role; it is more directly addressed by Use IAM Access Analyzer policy generation and last-accessed evidence to tighten grants. Access evidence helps identify unused permissions.

For the alternative failure a policy grants access to resources never used by the role, the control Use IAM Access Analyzer policy generation and last-accessed evidence to tighten grants is relevant: access evidence helps identify unused permissions. Here the evidence instead is a role policy has a finding for access to external AWS accounts. The selected technical mechanism is Inspect IAM Access Analyzer external-access findings and the affected resource policy: access Analyzer detects resource sharing outside the defined trust zone.

The competing option Enable organization CloudTrail events and analyze AssumeRole activity would be useful when the architecture needs a central log of every role assumption by an operator. CloudTrail captures STS calls and their requester context. The present issue is a role policy has a finding for access to external AWS accounts; it is more directly addressed by Inspect IAM Access Analyzer external-access findings and the affected resource policy. Access Analyzer detects resource sharing outside the defined trust zone.

The option Remove or narrow the resource-policy deny only after authorized review addresses a separate condition: a role has a valid trust relationship but is denied access by a separate explicit resource-policy Deny. An explicit deny overrides an identity-policy allow. The actual requirement is a role policy has a finding for access to external AWS accounts. Recommended corrective action: Inspect IAM Access Analyzer external-access findings and the affected resource policy. Access Analyzer detects resource sharing outside the defined trust zone.

The competing option Restrict iam:PassRole to approved target role ARNs and compatible services would be useful when a developer needs a deploy-time service role but should not create arbitrary privileged roles. PassRole permission controls which role a principal may delegate to a service. The present issue is the architecture needs a central log of every role assumption by an operator; it is more directly addressed by Enable organization CloudTrail events and analyze AssumeRole activity. CloudTrail captures STS calls and their requester context.

The option Use IAM Access Analyzer policy generation and last-accessed evidence to tighten grants addresses a separate condition: a policy grants access to resources never used by the role. Access evidence helps identify unused permissions. The actual requirement is the architecture needs a central log of every role assumption by an operator. Recommended corrective action: Enable organization CloudTrail events and analyze AssumeRole activity. CloudTrail captures STS calls and their requester context.

Inspect IAM Access Analyzer external-access findings and the affected resource policy would help if a role policy has a finding for access to external AWS accounts. Access Analyzer detects resource sharing outside the defined trust zone. That is not the symptom described here: the architecture needs a central log of every role assumption by an operator. The matching response is Enable organization CloudTrail events and analyze AssumeRole activity, because cloudTrail captures STS calls and their requester context.

The competing option Remove or narrow the resource-policy deny only after authorized review would be useful when a role has a valid trust relationship but is denied access by a separate explicit resource-policy Deny. An explicit deny overrides an identity-policy allow. The present issue is a developer needs a deploy-time service role but should not create arbitrary privileged roles; it is more directly addressed by Restrict iam:PassRole to approved target role ARNs and compatible services. PassRole permission controls which role a principal may delegate to a service.

Enable organization CloudTrail events and analyze AssumeRole activity would help if the architecture needs a central log of every role assumption by an operator. CloudTrail captures STS calls and their requester context. That is not the symptom described here: a developer needs a deploy-time service role but should not create arbitrary privileged roles. The matching response is Restrict iam:PassRole to approved target role ARNs and compatible services, because passRole permission controls which role a principal may delegate to a service.

For the alternative failure a role policy has a finding for access to external AWS accounts, the control Inspect IAM Access Analyzer external-access findings and the affected resource policy is relevant: access Analyzer detects resource sharing outside the defined trust zone. Here the evidence instead is a developer needs a deploy-time service role but should not create arbitrary privileged roles. The selected technical mechanism is Restrict iam:PassRole to approved target role ARNs and compatible services: passRole permission controls which role a principal may delegate to a service.

Enable organization CloudTrail events and analyze AssumeRole activity would help if the architecture needs a central log of every role assumption by an operator. CloudTrail captures STS calls and their requester context. That is not the symptom described here: a role has a valid trust relationship but is denied access by a separate explicit resource-policy Deny. The matching response is Remove or narrow the resource-policy deny only after authorized review, because an explicit deny overrides an identity-policy allow.

For the alternative failure a policy grants access to resources never used by the role, the control Use IAM Access Analyzer policy generation and last-accessed evidence to tighten grants is relevant: access evidence helps identify unused permissions. Here the evidence instead is a role has a valid trust relationship but is denied access by a separate explicit resource-policy Deny. The selected technical mechanism is Remove or narrow the resource-policy deny only after authorized review: an explicit deny overrides an identity-policy allow.

Restrict iam:PassRole to approved target role ARNs and compatible services solves a different operational problem where a developer needs a deploy-time service role but should not create arbitrary privileged roles. PassRole permission controls which role a principal may delegate to a service. It does not directly address a role has a valid trust relationship but is denied access by a separate explicit resource-policy Deny. The case calls for Remove or narrow the resource-policy deny only after authorized review, since an explicit deny overrides an identity-policy allow.