Amazon AWS Certified Solutions Architect - Associate SAA-C03 Bundle

The option Use supported EKS Pod Identity or scoped IRSA roles for service accounts addresses a separate condition: an EKS workload must call AWS APIs without sharing a node role. Pod-level IAM identities avoid broad worker-node credential sharing. The actual requirement is a pod has received a valid role but the target resource still denies requests. Recommended corrective action: Check resource policy and any KMS key policy as well as pod role permissions. Resource and KMS policies may independently restrict otherwise valid role credentials.

For the alternative failure an ECS task uses the task execution role for its own application AWS API calls, the control Assign an ECS task role for application calls separate from execution-role duties is relevant: task and execution roles have different responsibilities. Here the evidence instead is a pod has received a valid role but the target resource still denies requests. The selected technical mechanism is Check resource policy and any KMS key policy as well as pod role permissions: resource and KMS policies may independently restrict otherwise valid role credentials.

Attach an EC2 instance profile role and remove embedded IAM keys solves a different operational problem where an EC2 service stores a permanent IAM user access key in local configuration. Instance profiles vend temporary role credentials to EC2. It does not directly address a pod has received a valid role but the target resource still denies requests. The case calls for Check resource policy and any KMS key policy as well as pod role permissions, since resource and KMS policies may independently restrict otherwise valid role credentials.

Register and authorize a delegated administrator for that service would help if a new delegated security administrator must manage a supported organization service. Service-specific delegated administration separates central operations from the management account. That is not the symptom described here: developers want to share supported subnets across accounts in one organization. The matching response is Share the subnet through AWS RAM with designated principals, because rAM enables supported cross-account resource sharing.

Use AWS Control Tower Account Factory and approved landing-zone guardrails solves a different operational problem where teams are creating AWS accounts manually without mandatory baseline controls. Account Factory establishes governed multi-account provisioning. It does not directly address developers want to share supported subnets across accounts in one organization. The case calls for Share the subnet through AWS RAM with designated principals, since rAM enables supported cross-account resource sharing.

The competing option Move the account into the appropriate OU and validate inherited SCPs would be useful when a child account must be moved under a stricter policy group. OU placement controls inherited organization policy guardrails. The present issue is developers want to share supported subnets across accounts in one organization; it is more directly addressed by Share the subnet through AWS RAM with designated principals. RAM enables supported cross-account resource sharing.

For the alternative failure a new delegated security administrator must manage a supported organization service, the control Register and authorize a delegated administrator for that service is relevant: service-specific delegated administration separates central operations from the management account. Here the evidence instead is a member account attempts to change organization-wide billing settings. The selected technical mechanism is Use the management account's permitted organization-level billing controls: member-account IAM permission cannot grant management-only organization operations.

Use AWS Control Tower Account Factory and approved landing-zone guardrails solves a different operational problem where teams are creating AWS accounts manually without mandatory baseline controls. Account Factory establishes governed multi-account provisioning. It does not directly address a member account attempts to change organization-wide billing settings. The case calls for Use the management account's permitted organization-level billing controls, since member-account IAM permission cannot grant management-only organization operations.

The competing option Move the account into the appropriate OU and validate inherited SCPs would be useful when a child account must be moved under a stricter policy group. OU placement controls inherited organization policy guardrails. The present issue is a member account attempts to change organization-wide billing settings; it is more directly addressed by Use the management account's permitted organization-level billing controls. Member-account IAM permission cannot grant management-only organization operations.

Use AWS Control Tower Account Factory and approved landing-zone guardrails solves a different operational problem where teams are creating AWS accounts manually without mandatory baseline controls. Account Factory establishes governed multi-account provisioning. It does not directly address a child account must be moved under a stricter policy group. The case calls for Move the account into the appropriate OU and validate inherited SCPs, since oU placement controls inherited organization policy guardrails.

The competing option Register and authorize a delegated administrator for that service would be useful when a new delegated security administrator must manage a supported organization service. Service-specific delegated administration separates central operations from the management account. The present issue is a child account must be moved under a stricter policy group; it is more directly addressed by Move the account into the appropriate OU and validate inherited SCPs. OU placement controls inherited organization policy guardrails.

The option Share the subnet through AWS RAM with designated principals addresses a separate condition: developers want to share supported subnets across accounts in one organization. RAM enables supported cross-account resource sharing. The actual requirement is a child account must be moved under a stricter policy group. Recommended corrective action: Move the account into the appropriate OU and validate inherited SCPs. OU placement controls inherited organization policy guardrails.

The competing option Register and authorize a delegated administrator for that service would be useful when a new delegated security administrator must manage a supported organization service. Service-specific delegated administration separates central operations from the management account. The present issue is teams are creating AWS accounts manually without mandatory baseline controls; it is more directly addressed by Use AWS Control Tower Account Factory and approved landing-zone guardrails. Account Factory establishes governed multi-account provisioning.

The option Move the account into the appropriate OU and validate inherited SCPs addresses a separate condition: a child account must be moved under a stricter policy group. OU placement controls inherited organization policy guardrails. The actual requirement is teams are creating AWS accounts manually without mandatory baseline controls. Recommended corrective action: Use AWS Control Tower Account Factory and approved landing-zone guardrails. Account Factory establishes governed multi-account provisioning.

For the alternative failure developers want to share supported subnets across accounts in one organization, the control Share the subnet through AWS RAM with designated principals is relevant: rAM enables supported cross-account resource sharing. Here the evidence instead is teams are creating AWS accounts manually without mandatory baseline controls. The selected technical mechanism is Use AWS Control Tower Account Factory and approved landing-zone guardrails: account Factory establishes governed multi-account provisioning.

The option Use AWS Control Tower Account Factory and approved landing-zone guardrails addresses a separate condition: teams are creating AWS accounts manually without mandatory baseline controls. Account Factory establishes governed multi-account provisioning. The actual requirement is a new delegated security administrator must manage a supported organization service. Recommended corrective action: Register and authorize a delegated administrator for that service. Service-specific delegated administration separates central operations from the management account.

For the alternative failure developers want to share supported subnets across accounts in one organization, the control Share the subnet through AWS RAM with designated principals is relevant: rAM enables supported cross-account resource sharing. Here the evidence instead is a new delegated security administrator must manage a supported organization service. The selected technical mechanism is Register and authorize a delegated administrator for that service: service-specific delegated administration separates central operations from the management account.

Use the management account's permitted organization-level billing controls solves a different operational problem where a member account attempts to change organization-wide billing settings. Member-account IAM permission cannot grant management-only organization operations. It does not directly address a new delegated security administrator must manage a supported organization service. The case calls for Register and authorize a delegated administrator for that service, since service-specific delegated administration separates central operations from the management account.

Remove wildcard trust and require specified identity or verified conditions would help if a role trust policy accidentally includes all principals with no condition. Broad trust may create unintended external entry points. That is not the symptom described here: an external system is handed the publisher's long-lived IAM user secret. The matching response is Replace secret-sharing with a cross-account AssumeRole integration, because role assumption avoids a permanent key retained by another company.

Limit role S3 permissions to the project's object ARN prefix and required list prefix solves a different operational problem where the partner must access only one project's S3 objects. Scoped bucket and object resources prevent broad object access. It does not directly address an external system is handed the publisher's long-lived IAM user secret. The case calls for Replace secret-sharing with a cross-account AssumeRole integration, since role assumption avoids a permanent key retained by another company.

The competing option Narrow the trust policy to the approved source role ARN would be useful when partners can assume a role from any AWS principal in their account. Principal-specific trust reduces the reachable assumption surface. The present issue is an external system is handed the publisher's long-lived IAM user secret; it is more directly addressed by Replace secret-sharing with a cross-account AssumeRole integration. Role assumption avoids a permanent key retained by another company.

For the alternative failure the partner must access only one project's S3 objects, the control Limit role S3 permissions to the project's object ARN prefix and required list prefix is relevant: scoped bucket and object resources prevent broad object access. Here the evidence instead is partners can assume a role from any AWS principal in their account. The selected technical mechanism is Narrow the trust policy to the approved source role ARN: principal-specific trust reduces the reachable assumption surface.

Replace secret-sharing with a cross-account AssumeRole integration solves a different operational problem where an external system is handed the publisher's long-lived IAM user secret. Role assumption avoids a permanent key retained by another company. It does not directly address partners can assume a role from any AWS principal in their account. The case calls for Narrow the trust policy to the approved source role ARN, since principal-specific trust reduces the reachable assumption surface.

The option Remove wildcard trust and require specified identity or verified conditions addresses a separate condition: a role trust policy accidentally includes all principals with no condition. Broad trust may create unintended external entry points. The actual requirement is partners can assume a role from any AWS principal in their account. Recommended corrective action: Narrow the trust policy to the approved source role ARN. Principal-specific trust reduces the reachable assumption surface.

Limit role S3 permissions to the project's object ARN prefix and required list prefix solves a different operational problem where the partner must access only one project's S3 objects. Scoped bucket and object resources prevent broad object access. It does not directly address a role trust policy accidentally includes all principals with no condition. The case calls for Remove wildcard trust and require specified identity or verified conditions, since broad trust may create unintended external entry points.

The option Narrow the trust policy to the approved source role ARN addresses a separate condition: partners can assume a role from any AWS principal in their account. Principal-specific trust reduces the reachable assumption surface. The actual requirement is a role trust policy accidentally includes all principals with no condition. Recommended corrective action: Remove wildcard trust and require specified identity or verified conditions. Broad trust may create unintended external entry points.

Allow cross-account key use through key policy plus the caller's IAM policy would help if a customer-managed KMS key is needed for partner decrypt operations. Cross-account KMS use requires permissions from the key owner and consumer. That is not the symptom described here: a role trust policy accidentally includes all principals with no condition. The matching response is Remove wildcard trust and require specified identity or verified conditions, because broad trust may create unintended external entry points.

The competing option Replace secret-sharing with a cross-account AssumeRole integration would be useful when an external system is handed the publisher's long-lived IAM user secret. Role assumption avoids a permanent key retained by another company. The present issue is a customer-managed KMS key is needed for partner decrypt operations; it is more directly addressed by Allow cross-account key use through key policy plus the caller's IAM policy. Cross-account KMS use requires permissions from the key owner and consumer.

The option Remove wildcard trust and require specified identity or verified conditions addresses a separate condition: a role trust policy accidentally includes all principals with no condition. Broad trust may create unintended external entry points. The actual requirement is a customer-managed KMS key is needed for partner decrypt operations. Recommended corrective action: Allow cross-account key use through key policy plus the caller's IAM policy. Cross-account KMS use requires permissions from the key owner and consumer.

For the alternative failure partners can assume a role from any AWS principal in their account, the control Narrow the trust policy to the approved source role ARN is relevant: principal-specific trust reduces the reachable assumption surface. Here the evidence instead is a customer-managed KMS key is needed for partner decrypt operations. The selected technical mechanism is Allow cross-account key use through key policy plus the caller's IAM policy: cross-account KMS use requires permissions from the key owner and consumer.

The option Remove wildcard trust and require specified identity or verified conditions addresses a separate condition: a role trust policy accidentally includes all principals with no condition. Broad trust may create unintended external entry points. The actual requirement is the partner must access only one project's S3 objects. Recommended corrective action: Limit role S3 permissions to the project's object ARN prefix and required list prefix. Scoped bucket and object resources prevent broad object access.

For the alternative failure an external system is handed the publisher's long-lived IAM user secret, the control Replace secret-sharing with a cross-account AssumeRole integration is relevant: role assumption avoids a permanent key retained by another company. Here the evidence instead is the partner must access only one project's S3 objects. The selected technical mechanism is Limit role S3 permissions to the project's object ARN prefix and required list prefix: scoped bucket and object resources prevent broad object access.

Narrow the trust policy to the approved source role ARN solves a different operational problem where partners can assume a role from any AWS principal in their account. Principal-specific trust reduces the reachable assumption surface. It does not directly address the partner must access only one project's S3 objects. The case calls for Limit role S3 permissions to the project's object ARN prefix and required list prefix, since scoped bucket and object resources prevent broad object access.