Amazon AWS Certified Solutions Architect - Associate SAA-C03 Bundle

The option Query organization CloudTrail management event history for policy APIs addresses a separate condition: security cannot tell who modified a sensitive IAM policy yesterday. CloudTrail records IAM policy modification calls. The actual requirement is a role credential is suspected compromised during an investigation. Recommended corrective action: Revoke affected role sessions and remove its unauthorized trust or permissions. Session invalidation and policy cleanup curtail future compromised use.

For the alternative failure analysts need historical configuration state of an IAM role or security group, the control Use AWS Config resource history and configuration timelines is relevant: config tracks supported resource configuration changes. Here the evidence instead is a role credential is suspected compromised during an investigation. The selected technical mechanism is Revoke affected role sessions and remove its unauthorized trust or permissions: session invalidation and policy cleanup curtail future compromised use.

Generate IAM Access Analyzer external-access findings for the bucket solves a different operational problem where a bucket policy exposes objects to unknown external principals. Analyzer identifies public or cross-boundary resource access. It does not directly address a role credential is suspected compromised during an investigation. The case calls for Revoke affected role sessions and remove its unauthorized trust or permissions, since session invalidation and policy cleanup curtail future compromised use.

For the alternative failure requests from public addresses must not call an internal administrative API, the control Restrict API calls using supported SourceIp or SourceVpce conditions is relevant: context keys can narrow allowed request network sources. Here the evidence instead is a principal must only manage resources with its matching environment tag. The selected technical mechanism is Apply ABAC with aws:PrincipalTag and aws:ResourceTag conditions: matching tags constrain permissions by environment.

Add aws:PrincipalOrgID condition to the bucket resource policy solves a different operational problem where only principals in a designated AWS organization should access an S3 resource. Organization identity conditions bound eligible AWS account principals. It does not directly address a principal must only manage resources with its matching environment tag. The case calls for Apply ABAC with aws:PrincipalTag and aws:ResourceTag conditions, since matching tags constrain permissions by environment.

The competing option Require the relevant MFA context condition in the role trust policy would be useful when users should assume a sensitive role only when MFA is present. Trust conditions can require a second-factor-authenticated session. The present issue is a principal must only manage resources with its matching environment tag; it is more directly addressed by Apply ABAC with aws:PrincipalTag and aws:ResourceTag conditions. Matching tags constrain permissions by environment.

For the alternative failure only principals in a designated AWS organization should access an S3 resource, the control Add aws:PrincipalOrgID condition to the bucket resource policy is relevant: organization identity conditions bound eligible AWS account principals. Here the evidence instead is requests from public addresses must not call an internal administrative API. The selected technical mechanism is Restrict API calls using supported SourceIp or SourceVpce conditions: context keys can narrow allowed request network sources.

Apply ABAC with aws:PrincipalTag and aws:ResourceTag conditions solves a different operational problem where a principal must only manage resources with its matching environment tag. Matching tags constrain permissions by environment. It does not directly address requests from public addresses must not call an internal administrative API. The case calls for Restrict API calls using supported SourceIp or SourceVpce conditions, since context keys can narrow allowed request network sources.

The competing option Give list operations a bucket ARN and object operations object ARNs would be useful when an S3 multipart upload works but a list request is incorrectly scoped to an object ARN. S3 list and object actions use different resource types. The present issue is requests from public addresses must not call an internal administrative API; it is more directly addressed by Restrict API calls using supported SourceIp or SourceVpce conditions. Context keys can narrow allowed request network sources.

Restrict API calls using supported SourceIp or SourceVpce conditions solves a different operational problem where requests from public addresses must not call an internal administrative API. Context keys can narrow allowed request network sources. It does not directly address users should assume a sensitive role only when MFA is present. The case calls for Require the relevant MFA context condition in the role trust policy, since trust conditions can require a second-factor-authenticated session.

The competing option Add aws:PrincipalOrgID condition to the bucket resource policy would be useful when only principals in a designated AWS organization should access an S3 resource. Organization identity conditions bound eligible AWS account principals. The present issue is users should assume a sensitive role only when MFA is present; it is more directly addressed by Require the relevant MFA context condition in the role trust policy. Trust conditions can require a second-factor-authenticated session.

The option Give list operations a bucket ARN and object operations object ARNs addresses a separate condition: an S3 multipart upload works but a list request is incorrectly scoped to an object ARN. S3 list and object actions use different resource types. The actual requirement is users should assume a sensitive role only when MFA is present. Recommended corrective action: Require the relevant MFA context condition in the role trust policy. Trust conditions can require a second-factor-authenticated session.

The competing option Apply ABAC with aws:PrincipalTag and aws:ResourceTag conditions would be useful when a principal must only manage resources with its matching environment tag. Matching tags constrain permissions by environment. The present issue is only principals in a designated AWS organization should access an S3 resource; it is more directly addressed by Add aws:PrincipalOrgID condition to the bucket resource policy. Organization identity conditions bound eligible AWS account principals.

The option Require the relevant MFA context condition in the role trust policy addresses a separate condition: users should assume a sensitive role only when MFA is present. Trust conditions can require a second-factor-authenticated session. The actual requirement is only principals in a designated AWS organization should access an S3 resource. Recommended corrective action: Add aws:PrincipalOrgID condition to the bucket resource policy. Organization identity conditions bound eligible AWS account principals.

Restrict API calls using supported SourceIp or SourceVpce conditions would help if requests from public addresses must not call an internal administrative API. Context keys can narrow allowed request network sources. That is not the symptom described here: only principals in a designated AWS organization should access an S3 resource. The matching response is Add aws:PrincipalOrgID condition to the bucket resource policy, because organization identity conditions bound eligible AWS account principals.

The option Add aws:PrincipalOrgID condition to the bucket resource policy addresses a separate condition: only principals in a designated AWS organization should access an S3 resource. Organization identity conditions bound eligible AWS account principals. The actual requirement is an S3 multipart upload works but a list request is incorrectly scoped to an object ARN. Recommended corrective action: Give list operations a bucket ARN and object operations object ARNs. S3 list and object actions use different resource types.

Restrict API calls using supported SourceIp or SourceVpce conditions would help if requests from public addresses must not call an internal administrative API. Context keys can narrow allowed request network sources. That is not the symptom described here: an S3 multipart upload works but a list request is incorrectly scoped to an object ARN. The matching response is Give list operations a bucket ARN and object operations object ARNs, because s3 list and object actions use different resource types.

For the alternative failure a principal must only manage resources with its matching environment tag, the control Apply ABAC with aws:PrincipalTag and aws:ResourceTag conditions is relevant: matching tags constrain permissions by environment. Here the evidence instead is an S3 multipart upload works but a list request is incorrectly scoped to an object ARN. The selected technical mechanism is Give list operations a bucket ARN and object operations object ARNs: s3 list and object actions use different resource types.

Provide IAM Identity Center assignments to workforce groups would help if company employees need access to AWS consoles across multiple accounts. IAM Identity Center targets workforce console access. That is not the symptom described here: customers need registration and password recovery for a new mobile app. The matching response is Use Cognito user pools to manage application user directories, because a user pool provides customer sign-up and authentication.

Enforce tenant-level authorization at the service/data layer solves a different operational problem where API authentication succeeds but access to a tenant record crosses tenant boundaries. Identity authentication alone does not establish row-level tenant permission. It does not directly address customers need registration and password recovery for a new mobile app. The case calls for Use Cognito user pools to manage application user directories, since a user pool provides customer sign-up and authentication.

The competing option Configure the appropriate JWT or Cognito authorizer for API Gateway would be useful when a JWT from the consumer app must authorize API routes. API authorizers evaluate application bearer tokens. The present issue is customers need registration and password recovery for a new mobile app; it is more directly addressed by Use Cognito user pools to manage application user directories. A user pool provides customer sign-up and authentication.

Use Cognito user pools to manage application user directories solves a different operational problem where customers need registration and password recovery for a new mobile app. A user pool provides customer sign-up and authentication. It does not directly address an app user needs temporary AWS credentials for permitted uploads. The case calls for Use Cognito identity pool role mapping with scoped permissions where appropriate, since identity pools can exchange identity assertions for temporary AWS credentials.

The competing option Configure the appropriate JWT or Cognito authorizer for API Gateway would be useful when a JWT from the consumer app must authorize API routes. API authorizers evaluate application bearer tokens. The present issue is an app user needs temporary AWS credentials for permitted uploads; it is more directly addressed by Use Cognito identity pool role mapping with scoped permissions where appropriate. Identity pools can exchange identity assertions for temporary AWS credentials.

The option Provide IAM Identity Center assignments to workforce groups addresses a separate condition: company employees need access to AWS consoles across multiple accounts. IAM Identity Center targets workforce console access. The actual requirement is an app user needs temporary AWS credentials for permitted uploads. Recommended corrective action: Use Cognito identity pool role mapping with scoped permissions where appropriate. Identity pools can exchange identity assertions for temporary AWS credentials.

Configure the appropriate JWT or Cognito authorizer for API Gateway solves a different operational problem where a JWT from the consumer app must authorize API routes. API authorizers evaluate application bearer tokens. It does not directly address company employees need access to AWS consoles across multiple accounts. The case calls for Provide IAM Identity Center assignments to workforce groups, since IAM Identity Center targets workforce console access.

The competing option Enforce tenant-level authorization at the service/data layer would be useful when API authentication succeeds but access to a tenant record crosses tenant boundaries. Identity authentication alone does not establish row-level tenant permission. The present issue is company employees need access to AWS consoles across multiple accounts; it is more directly addressed by Provide IAM Identity Center assignments to workforce groups. IAM Identity Center targets workforce console access.

The option Use Cognito user pools to manage application user directories addresses a separate condition: customers need registration and password recovery for a new mobile app. A user pool provides customer sign-up and authentication. The actual requirement is company employees need access to AWS consoles across multiple accounts. Recommended corrective action: Provide IAM Identity Center assignments to workforce groups. IAM Identity Center targets workforce console access.

The competing option Use Cognito user pools to manage application user directories would be useful when customers need registration and password recovery for a new mobile app. A user pool provides customer sign-up and authentication. The present issue is a JWT from the consumer app must authorize API routes; it is more directly addressed by Configure the appropriate JWT or Cognito authorizer for API Gateway. API authorizers evaluate application bearer tokens.

The option Use Cognito identity pool role mapping with scoped permissions where appropriate addresses a separate condition: an app user needs temporary AWS credentials for permitted uploads. Identity pools can exchange identity assertions for temporary AWS credentials. The actual requirement is a JWT from the consumer app must authorize API routes. Recommended corrective action: Configure the appropriate JWT or Cognito authorizer for API Gateway. API authorizers evaluate application bearer tokens.

For the alternative failure API authentication succeeds but access to a tenant record crosses tenant boundaries, the control Enforce tenant-level authorization at the service/data layer is relevant: identity authentication alone does not establish row-level tenant permission. Here the evidence instead is a JWT from the consumer app must authorize API routes. The selected technical mechanism is Configure the appropriate JWT or Cognito authorizer for API Gateway: API authorizers evaluate application bearer tokens.

Provide IAM Identity Center assignments to workforce groups would help if company employees need access to AWS consoles across multiple accounts. IAM Identity Center targets workforce console access. That is not the symptom described here: API authentication succeeds but access to a tenant record crosses tenant boundaries. The matching response is Enforce tenant-level authorization at the service/data layer, because identity authentication alone does not establish row-level tenant permission.

For the alternative failure customers need registration and password recovery for a new mobile app, the control Use Cognito user pools to manage application user directories is relevant: a user pool provides customer sign-up and authentication. Here the evidence instead is API authentication succeeds but access to a tenant record crosses tenant boundaries. The selected technical mechanism is Enforce tenant-level authorization at the service/data layer: identity authentication alone does not establish row-level tenant permission.

Use Cognito identity pool role mapping with scoped permissions where appropriate solves a different operational problem where an app user needs temporary AWS credentials for permitted uploads. Identity pools can exchange identity assertions for temporary AWS credentials. It does not directly address API authentication succeeds but access to a tenant record crosses tenant boundaries. The case calls for Enforce tenant-level authorization at the service/data layer, since identity authentication alone does not establish row-level tenant permission.