Amazon AWS Certified Solutions Architect - Associate SAA-C03 Bundle

Assign permission sets through IAM Identity Center with federated identities would help if employees manually create IAM users separately in every member account. Central permission sets scale workforce access across accounts. That is not the symptom described here: a company uses a directory for employees and a separate customer identity pool for app users. The matching response is Use IAM Identity Center for workforce and Amazon Cognito for consumer application identities, because workforce SSO and application-user authentication address different audiences.

For the alternative failure a team must access only a development account and not production, the control Assign the team's permission set only to the approved account is relevant: account-level assignments bound which account roles are provisioned. Here the evidence instead is a company uses a directory for employees and a separate customer identity pool for app users. The selected technical mechanism is Use IAM Identity Center for workforce and Amazon Cognito for consumer application identities: workforce SSO and application-user authentication address different audiences.

Configure supported SCIM user/group provisioning to IAM Identity Center solves a different operational problem where users authenticate to the corporate IdP but are not automatically provisioned for app access. SCIM synchronizes workforce identities and groups to the access directory. It does not directly address a company uses a directory for employees and a separate customer identity pool for app users. The case calls for Use IAM Identity Center for workforce and Amazon Cognito for consumer application identities, since workforce SSO and application-user authentication address different audiences.

Apply a resource policy scoped with supported aws:SourceVpce conditions would help if a private API must only be callable through an approved interface VPC endpoint. API Gateway resource policies can restrict origin VPC endpoints. That is not the symptom described here: a server-to-server client calls an IAM-authorized API Gateway method anonymously. The matching response is Sign requests with SigV4 credentials permitted by execute-api policy, because IAM-authorized API methods require authenticated signed AWS requests.

For the alternative failure a Lambda authorizer accepts a token but grants every API resource unconditionally, the control Return policies limited to the authorized method/resource and requester is relevant: lambda-authorizer output controls downstream route permission. Here the evidence instead is a server-to-server client calls an IAM-authorized API Gateway method anonymously. The selected technical mechanism is Sign requests with SigV4 credentials permitted by execute-api policy: IAM-authorized API methods require authenticated signed AWS requests.

The competing option Use an Amazon Cognito user pool and an appropriate API authorizer would be useful when a web mobile app needs managed customer sign-up and token validation. Cognito issues app-user tokens for frontend identities. The present issue is a server-to-server client calls an IAM-authorized API Gateway method anonymously; it is more directly addressed by Sign requests with SigV4 credentials permitted by execute-api policy. IAM-authorized API methods require authenticated signed AWS requests.

Sign requests with SigV4 credentials permitted by execute-api policy solves a different operational problem where a server-to-server client calls an IAM-authorized API Gateway method anonymously. IAM-authorized API methods require authenticated signed AWS requests. It does not directly address a web mobile app needs managed customer sign-up and token validation. The case calls for Use an Amazon Cognito user pool and an appropriate API authorizer, since cognito issues app-user tokens for frontend identities.

The competing option Correct the restrictive resource policy for the approved principal and action would be useful when an identity-based allow permits a request but a resource-based explicit deny blocks it. Resource-policy explicit deny wins during the permission decision. The present issue is a web mobile app needs managed customer sign-up and token validation; it is more directly addressed by Use an Amazon Cognito user pool and an appropriate API authorizer. Cognito issues app-user tokens for frontend identities.

The option Apply a resource policy scoped with supported aws:SourceVpce conditions addresses a separate condition: a private API must only be callable through an approved interface VPC endpoint. API Gateway resource policies can restrict origin VPC endpoints. The actual requirement is a web mobile app needs managed customer sign-up and token validation. Recommended corrective action: Use an Amazon Cognito user pool and an appropriate API authorizer. Cognito issues app-user tokens for frontend identities.

Correct the restrictive resource policy for the approved principal and action solves a different operational problem where an identity-based allow permits a request but a resource-based explicit deny blocks it. Resource-policy explicit deny wins during the permission decision. It does not directly address a private API must only be callable through an approved interface VPC endpoint. The case calls for Apply a resource policy scoped with supported aws:SourceVpce conditions, since API Gateway resource policies can restrict origin VPC endpoints.

The option Use an Amazon Cognito user pool and an appropriate API authorizer addresses a separate condition: a web mobile app needs managed customer sign-up and token validation. Cognito issues app-user tokens for frontend identities. The actual requirement is a private API must only be callable through an approved interface VPC endpoint. Recommended corrective action: Apply a resource policy scoped with supported aws:SourceVpce conditions. API Gateway resource policies can restrict origin VPC endpoints.

Sign requests with SigV4 credentials permitted by execute-api policy would help if a server-to-server client calls an IAM-authorized API Gateway method anonymously. IAM-authorized API methods require authenticated signed AWS requests. That is not the symptom described here: a private API must only be callable through an approved interface VPC endpoint. The matching response is Apply a resource policy scoped with supported aws:SourceVpce conditions, because API Gateway resource policies can restrict origin VPC endpoints.

The competing option Use an Amazon Cognito user pool and an appropriate API authorizer would be useful when a web mobile app needs managed customer sign-up and token validation. Cognito issues app-user tokens for frontend identities. The present issue is a Lambda authorizer accepts a token but grants every API resource unconditionally; it is more directly addressed by Return policies limited to the authorized method/resource and requester. Lambda-authorizer output controls downstream route permission.

The option Correct the restrictive resource policy for the approved principal and action addresses a separate condition: an identity-based allow permits a request but a resource-based explicit deny blocks it. Resource-policy explicit deny wins during the permission decision. The actual requirement is a Lambda authorizer accepts a token but grants every API resource unconditionally. Recommended corrective action: Return policies limited to the authorized method/resource and requester. Lambda-authorizer output controls downstream route permission.

For the alternative failure a server-to-server client calls an IAM-authorized API Gateway method anonymously, the control Sign requests with SigV4 credentials permitted by execute-api policy is relevant: IAM-authorized API methods require authenticated signed AWS requests. Here the evidence instead is a Lambda authorizer accepts a token but grants every API resource unconditionally. The selected technical mechanism is Return policies limited to the authorized method/resource and requester: lambda-authorizer output controls downstream route permission.

Return policies limited to the authorized method/resource and requester would help if a Lambda authorizer accepts a token but grants every API resource unconditionally. Lambda-authorizer output controls downstream route permission. That is not the symptom described here: an identity-based allow permits a request but a resource-based explicit deny blocks it. The matching response is Correct the restrictive resource policy for the approved principal and action, because resource-policy explicit deny wins during the permission decision.

For the alternative failure a private API must only be callable through an approved interface VPC endpoint, the control Apply a resource policy scoped with supported aws:SourceVpce conditions is relevant: API Gateway resource policies can restrict origin VPC endpoints. Here the evidence instead is an identity-based allow permits a request but a resource-based explicit deny blocks it. The selected technical mechanism is Correct the restrictive resource policy for the approved principal and action: resource-policy explicit deny wins during the permission decision.

Sign requests with SigV4 credentials permitted by execute-api policy solves a different operational problem where a server-to-server client calls an IAM-authorized API Gateway method anonymously. IAM-authorized API methods require authenticated signed AWS requests. It does not directly address an identity-based allow permits a request but a resource-based explicit deny blocks it. The case calls for Correct the restrictive resource policy for the approved principal and action, since resource-policy explicit deny wins during the permission decision.

Assign an ECS task role for application calls separate from execution-role duties would help if an ECS task uses the task execution role for its own application AWS API calls. Task and execution roles have different responsibilities. That is not the symptom described here: an EC2 service stores a permanent IAM user access key in local configuration. The matching response is Attach an EC2 instance profile role and remove embedded IAM keys, because instance profiles vend temporary role credentials to EC2.

For the alternative failure an EKS workload must call AWS APIs without sharing a node role, the control Use supported EKS Pod Identity or scoped IRSA roles for service accounts is relevant: pod-level IAM identities avoid broad worker-node credential sharing. Here the evidence instead is an EC2 service stores a permanent IAM user access key in local configuration. The selected technical mechanism is Attach an EC2 instance profile role and remove embedded IAM keys: instance profiles vend temporary role credentials to EC2.

The competing option Check resource policy and any KMS key policy as well as pod role permissions would be useful when a pod has received a valid role but the target resource still denies requests. Resource and KMS policies may independently restrict otherwise valid role credentials. The present issue is an EC2 service stores a permanent IAM user access key in local configuration; it is more directly addressed by Attach an EC2 instance profile role and remove embedded IAM keys. Instance profiles vend temporary role credentials to EC2.

For the alternative failure a pod has received a valid role but the target resource still denies requests, the control Check resource policy and any KMS key policy as well as pod role permissions is relevant: resource and KMS policies may independently restrict otherwise valid role credentials. Here the evidence instead is lambda function code contains static IAM secret values for S3 access. The selected technical mechanism is Configure a Lambda execution role with narrowly scoped S3 permissions: lambda obtains temporary credentials from its execution role.

The competing option Use supported EKS Pod Identity or scoped IRSA roles for service accounts would be useful when an EKS workload must call AWS APIs without sharing a node role. Pod-level IAM identities avoid broad worker-node credential sharing. The present issue is lambda function code contains static IAM secret values for S3 access; it is more directly addressed by Configure a Lambda execution role with narrowly scoped S3 permissions. Lambda obtains temporary credentials from its execution role.

The option Attach an EC2 instance profile role and remove embedded IAM keys addresses a separate condition: an EC2 service stores a permanent IAM user access key in local configuration. Instance profiles vend temporary role credentials to EC2. The actual requirement is lambda function code contains static IAM secret values for S3 access. Recommended corrective action: Configure a Lambda execution role with narrowly scoped S3 permissions. Lambda obtains temporary credentials from its execution role.

Configure a Lambda execution role with narrowly scoped S3 permissions solves a different operational problem where lambda function code contains static IAM secret values for S3 access. Lambda obtains temporary credentials from its execution role. It does not directly address an ECS task uses the task execution role for its own application AWS API calls. The case calls for Assign an ECS task role for application calls separate from execution-role duties, since task and execution roles have different responsibilities.

The competing option Check resource policy and any KMS key policy as well as pod role permissions would be useful when a pod has received a valid role but the target resource still denies requests. Resource and KMS policies may independently restrict otherwise valid role credentials. The present issue is an ECS task uses the task execution role for its own application AWS API calls; it is more directly addressed by Assign an ECS task role for application calls separate from execution-role duties. Task and execution roles have different responsibilities.

Use supported EKS Pod Identity or scoped IRSA roles for service accounts would help if an EKS workload must call AWS APIs without sharing a node role. Pod-level IAM identities avoid broad worker-node credential sharing. That is not the symptom described here: an ECS task uses the task execution role for its own application AWS API calls. The matching response is Assign an ECS task role for application calls separate from execution-role duties, because task and execution roles have different responsibilities.

The competing option Configure a Lambda execution role with narrowly scoped S3 permissions would be useful when lambda function code contains static IAM secret values for S3 access. Lambda obtains temporary credentials from its execution role. The present issue is an EKS workload must call AWS APIs without sharing a node role; it is more directly addressed by Use supported EKS Pod Identity or scoped IRSA roles for service accounts. Pod-level IAM identities avoid broad worker-node credential sharing.

The option Check resource policy and any KMS key policy as well as pod role permissions addresses a separate condition: a pod has received a valid role but the target resource still denies requests. Resource and KMS policies may independently restrict otherwise valid role credentials. The actual requirement is an EKS workload must call AWS APIs without sharing a node role. Recommended corrective action: Use supported EKS Pod Identity or scoped IRSA roles for service accounts. Pod-level IAM identities avoid broad worker-node credential sharing.

Assign an ECS task role for application calls separate from execution-role duties would help if an ECS task uses the task execution role for its own application AWS API calls. Task and execution roles have different responsibilities. That is not the symptom described here: an EKS workload must call AWS APIs without sharing a node role. The matching response is Use supported EKS Pod Identity or scoped IRSA roles for service accounts, because pod-level IAM identities avoid broad worker-node credential sharing.

The option Use supported EKS Pod Identity or scoped IRSA roles for service accounts addresses a separate condition: an EKS workload must call AWS APIs without sharing a node role. Pod-level IAM identities avoid broad worker-node credential sharing. The actual requirement is a pod has received a valid role but the target resource still denies requests. Recommended corrective action: Check resource policy and any KMS key policy as well as pod role permissions. Resource and KMS policies may independently restrict otherwise valid role credentials.

For the alternative failure an ECS task uses the task execution role for its own application AWS API calls, the control Assign an ECS task role for application calls separate from execution-role duties is relevant: task and execution roles have different responsibilities. Here the evidence instead is a pod has received a valid role but the target resource still denies requests. The selected technical mechanism is Check resource policy and any KMS key policy as well as pod role permissions: resource and KMS policies may independently restrict otherwise valid role credentials.

Attach an EC2 instance profile role and remove embedded IAM keys solves a different operational problem where an EC2 service stores a permanent IAM user access key in local configuration. Instance profiles vend temporary role credentials to EC2. It does not directly address a pod has received a valid role but the target resource still denies requests. The case calls for Check resource policy and any KMS key policy as well as pod role permissions, since resource and KMS policies may independently restrict otherwise valid role credentials.