Amazon AWS Certified Solutions Architect - Associate SAA-C03 Bundle

Enable organization CloudTrail events and analyze AssumeRole activity would help if the architecture needs a central log of every role assumption by an operator. CloudTrail captures STS calls and their requester context. That is not the symptom described here: a role has a valid trust relationship but is denied access by a separate explicit resource-policy Deny. The matching response is Remove or narrow the resource-policy deny only after authorized review, because an explicit deny overrides an identity-policy allow.

For the alternative failure a policy grants access to resources never used by the role, the control Use IAM Access Analyzer policy generation and last-accessed evidence to tighten grants is relevant: access evidence helps identify unused permissions. Here the evidence instead is a role has a valid trust relationship but is denied access by a separate explicit resource-policy Deny. The selected technical mechanism is Remove or narrow the resource-policy deny only after authorized review: an explicit deny overrides an identity-policy allow.

Restrict iam:PassRole to approved target role ARNs and compatible services solves a different operational problem where a developer needs a deploy-time service role but should not create arbitrary privileged roles. PassRole permission controls which role a principal may delegate to a service. It does not directly address a role has a valid trust relationship but is denied access by a separate explicit resource-policy Deny. The case calls for Remove or narrow the resource-policy deny only after authorized review, since an explicit deny overrides an identity-policy allow.

Validate an independently accessible emergency access procedure and audit usage would help if an emergency access role has no tested recovery process when federation is down. Break-glass access must remain functional during identity-provider outages. That is not the symptom described here: root credentials are stored with a developer's ordinary password manager entry. The matching response is Move root credentials and MFA recovery materials into controlled break-glass custody, because separate emergency custody reduces routine account exposure.

For the alternative failure a root sign-in unexpectedly appears in audit records, the control Alert on CloudTrail root activity with EventBridge or monitoring rules is relevant: root API or console events are high-signal audit events. Here the evidence instead is root credentials are stored with a developer's ordinary password manager entry. The selected technical mechanism is Move root credentials and MFA recovery materials into controlled break-glass custody: separate emergency custody reduces routine account exposure.

Delegate routine tasks to least-privileged roles rather than using root solves a different operational problem where administrators access root for ordinary tagging operations. Root should be reserved for tasks that actually require it. It does not directly address root credentials are stored with a developer's ordinary password manager entry. The case calls for Move root credentials and MFA recovery materials into controlled break-glass custody, since separate emergency custody reduces routine account exposure.

For the alternative failure root credentials are stored with a developer's ordinary password manager entry, the control Move root credentials and MFA recovery materials into controlled break-glass custody is relevant: separate emergency custody reduces routine account exposure. Here the evidence instead is administrators access root for ordinary tagging operations. The selected technical mechanism is Delegate routine tasks to least-privileged roles rather than using root: root should be reserved for tasks that actually require it.

The competing option Validate an independently accessible emergency access procedure and audit usage would be useful when an emergency access role has no tested recovery process when federation is down. Break-glass access must remain functional during identity-provider outages. The present issue is administrators access root for ordinary tagging operations; it is more directly addressed by Delegate routine tasks to least-privileged roles rather than using root. Root should be reserved for tasks that actually require it.

The option Alert on CloudTrail root activity with EventBridge or monitoring rules addresses a separate condition: a root sign-in unexpectedly appears in audit records. Root API or console events are high-signal audit events. The actual requirement is administrators access root for ordinary tagging operations. Recommended corrective action: Delegate routine tasks to least-privileged roles rather than using root. Root should be reserved for tasks that actually require it.

Alert on CloudTrail root activity with EventBridge or monitoring rules solves a different operational problem where a root sign-in unexpectedly appears in audit records. Root API or console events are high-signal audit events. It does not directly address an emergency access role has no tested recovery process when federation is down. The case calls for Validate an independently accessible emergency access procedure and audit usage, since break-glass access must remain functional during identity-provider outages.

The competing option Move root credentials and MFA recovery materials into controlled break-glass custody would be useful when root credentials are stored with a developer's ordinary password manager entry. Separate emergency custody reduces routine account exposure. The present issue is an emergency access role has no tested recovery process when federation is down; it is more directly addressed by Validate an independently accessible emergency access procedure and audit usage. Break-glass access must remain functional during identity-provider outages.

The option Maintain current alternate security contacts and account recovery details addresses a separate condition: an AWS account has outdated security contact information. Accurate contacts support timely incident response and recovery. The actual requirement is an emergency access role has no tested recovery process when federation is down. Recommended corrective action: Validate an independently accessible emergency access procedure and audit usage. Break-glass access must remain functional during identity-provider outages.

The competing option Validate an independently accessible emergency access procedure and audit usage would be useful when an emergency access role has no tested recovery process when federation is down. Break-glass access must remain functional during identity-provider outages. The present issue is an AWS account has outdated security contact information; it is more directly addressed by Maintain current alternate security contacts and account recovery details. Accurate contacts support timely incident response and recovery.

The option Move root credentials and MFA recovery materials into controlled break-glass custody addresses a separate condition: root credentials are stored with a developer's ordinary password manager entry. Separate emergency custody reduces routine account exposure. The actual requirement is an AWS account has outdated security contact information. Recommended corrective action: Maintain current alternate security contacts and account recovery details. Accurate contacts support timely incident response and recovery.

For the alternative failure administrators access root for ordinary tagging operations, the control Delegate routine tasks to least-privileged roles rather than using root is relevant: root should be reserved for tasks that actually require it. Here the evidence instead is an AWS account has outdated security contact information. The selected technical mechanism is Maintain current alternate security contacts and account recovery details: accurate contacts support timely incident response and recovery.

The option Move root credentials and MFA recovery materials into controlled break-glass custody addresses a separate condition: root credentials are stored with a developer's ordinary password manager entry. Separate emergency custody reduces routine account exposure. The actual requirement is a root sign-in unexpectedly appears in audit records. Recommended corrective action: Alert on CloudTrail root activity with EventBridge or monitoring rules. Root API or console events are high-signal audit events.

Validate an independently accessible emergency access procedure and audit usage would help if an emergency access role has no tested recovery process when federation is down. Break-glass access must remain functional during identity-provider outages. That is not the symptom described here: a root sign-in unexpectedly appears in audit records. The matching response is Alert on CloudTrail root activity with EventBridge or monitoring rules, because root API or console events are high-signal audit events.

Maintain current alternate security contacts and account recovery details solves a different operational problem where an AWS account has outdated security contact information. Accurate contacts support timely incident response and recovery. It does not directly address a root sign-in unexpectedly appears in audit records. The case calls for Alert on CloudTrail root activity with EventBridge or monitoring rules, since root API or console events are high-signal audit events.

For the alternative failure users authenticate to the corporate IdP but are not automatically provisioned for app access, the control Configure supported SCIM user/group provisioning to IAM Identity Center is relevant: sCIM synchronizes workforce identities and groups to the access directory. Here the evidence instead is employees manually create IAM users separately in every member account. The selected technical mechanism is Assign permission sets through IAM Identity Center with federated identities: central permission sets scale workforce access across accounts.

Assign the team's permission set only to the approved account solves a different operational problem where a team must access only a development account and not production. Account-level assignments bound which account roles are provisioned. It does not directly address employees manually create IAM users separately in every member account. The case calls for Assign permission sets through IAM Identity Center with federated identities, since central permission sets scale workforce access across accounts.

The competing option Reprovision the updated permission set to affected AWS accounts would be useful when a permission set was edited but still has old permissions in the target account. Provisioning applies permission-set updates to account roles. The present issue is employees manually create IAM users separately in every member account; it is more directly addressed by Assign permission sets through IAM Identity Center with federated identities. Central permission sets scale workforce access across accounts.

Use IAM Identity Center for workforce and Amazon Cognito for consumer application identities solves a different operational problem where a company uses a directory for employees and a separate customer identity pool for app users. Workforce SSO and application-user authentication address different audiences. It does not directly address a team must access only a development account and not production. The case calls for Assign the team's permission set only to the approved account, since account-level assignments bound which account roles are provisioned.

The competing option Assign permission sets through IAM Identity Center with federated identities would be useful when employees manually create IAM users separately in every member account. Central permission sets scale workforce access across accounts. The present issue is a team must access only a development account and not production; it is more directly addressed by Assign the team's permission set only to the approved account. Account-level assignments bound which account roles are provisioned.

The option Configure supported SCIM user/group provisioning to IAM Identity Center addresses a separate condition: users authenticate to the corporate IdP but are not automatically provisioned for app access. SCIM synchronizes workforce identities and groups to the access directory. The actual requirement is a team must access only a development account and not production. Recommended corrective action: Assign the team's permission set only to the approved account. Account-level assignments bound which account roles are provisioned.

The competing option Reprovision the updated permission set to affected AWS accounts would be useful when a permission set was edited but still has old permissions in the target account. Provisioning applies permission-set updates to account roles. The present issue is users authenticate to the corporate IdP but are not automatically provisioned for app access; it is more directly addressed by Configure supported SCIM user/group provisioning to IAM Identity Center. SCIM synchronizes workforce identities and groups to the access directory.

The option Use IAM Identity Center for workforce and Amazon Cognito for consumer application identities addresses a separate condition: a company uses a directory for employees and a separate customer identity pool for app users. Workforce SSO and application-user authentication address different audiences. The actual requirement is users authenticate to the corporate IdP but are not automatically provisioned for app access. Recommended corrective action: Configure supported SCIM user/group provisioning to IAM Identity Center. SCIM synchronizes workforce identities and groups to the access directory.

Assign the team's permission set only to the approved account would help if a team must access only a development account and not production. Account-level assignments bound which account roles are provisioned. That is not the symptom described here: users authenticate to the corporate IdP but are not automatically provisioned for app access. The matching response is Configure supported SCIM user/group provisioning to IAM Identity Center, because sCIM synchronizes workforce identities and groups to the access directory.

The competing option Configure supported SCIM user/group provisioning to IAM Identity Center would be useful when users authenticate to the corporate IdP but are not automatically provisioned for app access. SCIM synchronizes workforce identities and groups to the access directory. The present issue is a permission set was edited but still has old permissions in the target account; it is more directly addressed by Reprovision the updated permission set to affected AWS accounts. Provisioning applies permission-set updates to account roles.

Assign permission sets through IAM Identity Center with federated identities would help if employees manually create IAM users separately in every member account. Central permission sets scale workforce access across accounts. That is not the symptom described here: a permission set was edited but still has old permissions in the target account. The matching response is Reprovision the updated permission set to affected AWS accounts, because provisioning applies permission-set updates to account roles.

For the alternative failure a team must access only a development account and not production, the control Assign the team's permission set only to the approved account is relevant: account-level assignments bound which account roles are provisioned. Here the evidence instead is a permission set was edited but still has old permissions in the target account. The selected technical mechanism is Reprovision the updated permission set to affected AWS accounts: provisioning applies permission-set updates to account roles.

Assign permission sets through IAM Identity Center with federated identities would help if employees manually create IAM users separately in every member account. Central permission sets scale workforce access across accounts. That is not the symptom described here: a company uses a directory for employees and a separate customer identity pool for app users. The matching response is Use IAM Identity Center for workforce and Amazon Cognito for consumer application identities, because workforce SSO and application-user authentication address different audiences.

For the alternative failure a team must access only a development account and not production, the control Assign the team's permission set only to the approved account is relevant: account-level assignments bound which account roles are provisioned. Here the evidence instead is a company uses a directory for employees and a separate customer identity pool for app users. The selected technical mechanism is Use IAM Identity Center for workforce and Amazon Cognito for consumer application identities: workforce SSO and application-user authentication address different audiences.

Configure supported SCIM user/group provisioning to IAM Identity Center solves a different operational problem where users authenticate to the corporate IdP but are not automatically provisioned for app access. SCIM synchronizes workforce identities and groups to the access directory. It does not directly address a company uses a directory for employees and a separate customer identity pool for app users. The case calls for Use IAM Identity Center for workforce and Amazon Cognito for consumer application identities, since workforce SSO and application-user authentication address different audiences.