Amazon AWS Certified Solutions Architect - Associate SAA-C03 Bundle

Provide IAM Identity Center assignments to workforce groups would help if company employees need access to AWS consoles across multiple accounts. IAM Identity Center targets workforce console access. That is not the symptom described here: API authentication succeeds but access to a tenant record crosses tenant boundaries. The matching response is Enforce tenant-level authorization at the service/data layer, because identity authentication alone does not establish row-level tenant permission.

For the alternative failure customers need registration and password recovery for a new mobile app, the control Use Cognito user pools to manage application user directories is relevant: a user pool provides customer sign-up and authentication. Here the evidence instead is API authentication succeeds but access to a tenant record crosses tenant boundaries. The selected technical mechanism is Enforce tenant-level authorization at the service/data layer: identity authentication alone does not establish row-level tenant permission.

Use Cognito identity pool role mapping with scoped permissions where appropriate solves a different operational problem where an app user needs temporary AWS credentials for permitted uploads. Identity pools can exchange identity assertions for temporary AWS credentials. It does not directly address API authentication succeeds but access to a tenant record crosses tenant boundaries. The case calls for Enforce tenant-level authorization at the service/data layer, since identity authentication alone does not establish row-level tenant permission.

For the alternative failure engineers cannot tell whether a role assumption came from approved automation, the control Inspect CloudTrail AssumeRole events and external source identity context is relevant: sTS CloudTrail data reveals assumption actor and session metadata. Here the evidence instead is a microservice assumes a role without any session attribution. The selected technical mechanism is Set and audit a supported role session name or source identity: session attributes strengthen attribution across role use.

Honor AWS STS role-chaining duration constraints solves a different operational problem where a chained session unexpectedly expires before the requested twelve hours. Chained role sessions are subject to shorter maximum duration. It does not directly address a microservice assumes a role without any session attribution. The case calls for Set and audit a supported role session name or source identity, since session attributes strengthen attribution across role use.

The competing option Use supported session tags and transitive-tag settings would be useful when a permission needs to flow from job run to downstream logs without a static user. Transitive tags can preserve approved identity attributes across role chaining. The present issue is a microservice assumes a role without any session attribution; it is more directly addressed by Set and audit a supported role session name or source identity. Session attributes strengthen attribution across role use.

For the alternative failure engineers cannot tell whether a role assumption came from approved automation, the control Inspect CloudTrail AssumeRole events and external source identity context is relevant: sTS CloudTrail data reveals assumption actor and session metadata. Here the evidence instead is a service role must assume another role in a different account. The selected technical mechanism is Configure the target trust plus caller sts:AssumeRole permission: role chaining needs trust and caller authorization.

The competing option Honor AWS STS role-chaining duration constraints would be useful when a chained session unexpectedly expires before the requested twelve hours. Chained role sessions are subject to shorter maximum duration. The present issue is a service role must assume another role in a different account; it is more directly addressed by Configure the target trust plus caller sts:AssumeRole permission. Role chaining needs trust and caller authorization.

The option Set and audit a supported role session name or source identity addresses a separate condition: a microservice assumes a role without any session attribution. Session attributes strengthen attribution across role use. The actual requirement is a service role must assume another role in a different account. Recommended corrective action: Configure the target trust plus caller sts:AssumeRole permission. Role chaining needs trust and caller authorization.

Inspect CloudTrail AssumeRole events and external source identity context solves a different operational problem where engineers cannot tell whether a role assumption came from approved automation. STS CloudTrail data reveals assumption actor and session metadata. It does not directly address a chained session unexpectedly expires before the requested twelve hours. The case calls for Honor AWS STS role-chaining duration constraints, since chained role sessions are subject to shorter maximum duration.

The option Use supported session tags and transitive-tag settings addresses a separate condition: a permission needs to flow from job run to downstream logs without a static user. Transitive tags can preserve approved identity attributes across role chaining. The actual requirement is a chained session unexpectedly expires before the requested twelve hours. Recommended corrective action: Honor AWS STS role-chaining duration constraints. Chained role sessions are subject to shorter maximum duration.

Configure the target trust plus caller sts:AssumeRole permission would help if a service role must assume another role in a different account. Role chaining needs trust and caller authorization. That is not the symptom described here: a chained session unexpectedly expires before the requested twelve hours. The matching response is Honor AWS STS role-chaining duration constraints, because chained role sessions are subject to shorter maximum duration.

The competing option Honor AWS STS role-chaining duration constraints would be useful when a chained session unexpectedly expires before the requested twelve hours. Chained role sessions are subject to shorter maximum duration. The present issue is a permission needs to flow from job run to downstream logs without a static user; it is more directly addressed by Use supported session tags and transitive-tag settings. Transitive tags can preserve approved identity attributes across role chaining.

Inspect CloudTrail AssumeRole events and external source identity context would help if engineers cannot tell whether a role assumption came from approved automation. STS CloudTrail data reveals assumption actor and session metadata. That is not the symptom described here: a permission needs to flow from job run to downstream logs without a static user. The matching response is Use supported session tags and transitive-tag settings, because transitive tags can preserve approved identity attributes across role chaining.

For the alternative failure a microservice assumes a role without any session attribution, the control Set and audit a supported role session name or source identity is relevant: session attributes strengthen attribution across role use. Here the evidence instead is a permission needs to flow from job run to downstream logs without a static user. The selected technical mechanism is Use supported session tags and transitive-tag settings: transitive tags can preserve approved identity attributes across role chaining.

Honor AWS STS role-chaining duration constraints would help if a chained session unexpectedly expires before the requested twelve hours. Chained role sessions are subject to shorter maximum duration. That is not the symptom described here: engineers cannot tell whether a role assumption came from approved automation. The matching response is Inspect CloudTrail AssumeRole events and external source identity context, because sTS CloudTrail data reveals assumption actor and session metadata.

For the alternative failure a service role must assume another role in a different account, the control Configure the target trust plus caller sts:AssumeRole permission is relevant: role chaining needs trust and caller authorization. Here the evidence instead is engineers cannot tell whether a role assumption came from approved automation. The selected technical mechanism is Inspect CloudTrail AssumeRole events and external source identity context: sTS CloudTrail data reveals assumption actor and session metadata.

Use supported session tags and transitive-tag settings solves a different operational problem where a permission needs to flow from job run to downstream logs without a static user. Transitive tags can preserve approved identity attributes across role chaining. It does not directly address engineers cannot tell whether a role assumption came from approved automation. The case calls for Inspect CloudTrail AssumeRole events and external source identity context, since sTS CloudTrail data reveals assumption actor and session metadata.

Design separate management-account controls since SCPs do not restrict it would help if the management account is assumed to obey all attached SCPs. Management account is outside SCP permission limits. That is not the symptom described here: a development administrator attempts to disable audit logging in their account. The matching response is Use organization-level SCP guardrails against prohibited logging changes, because sCP denies block member-account principals notwithstanding local Allow.

For the alternative failure a root principal tries to use prohibited organization APIs but remains allowed by account permissions, the control Ensure applicable SCP deny also covers member-account root principals is relevant: member-account root is generally subject to SCP constraints. Here the evidence instead is a development administrator attempts to disable audit logging in their account. The selected technical mechanism is Use organization-level SCP guardrails against prohibited logging changes: sCP denies block member-account principals notwithstanding local Allow.

Apply an SCP region guardrail with global-service exemptions solves a different operational problem where teams require prevention of nonapproved AWS Regions for supported resources. Region controls must avoid blocking globally scoped service APIs. It does not directly address a development administrator attempts to disable audit logging in their account. The case calls for Use organization-level SCP guardrails against prohibited logging changes, since sCP denies block member-account principals notwithstanding local Allow.

Apply an SCP region guardrail with global-service exemptions solves a different operational problem where teams require prevention of nonapproved AWS Regions for supported resources. Region controls must avoid blocking globally scoped service APIs. It does not directly address a root principal tries to use prohibited organization APIs but remains allowed by account permissions. The case calls for Ensure applicable SCP deny also covers member-account root principals, since member-account root is generally subject to SCP constraints.

The competing option Use organization-level SCP guardrails against prohibited logging changes would be useful when a development administrator attempts to disable audit logging in their account. SCP denies block member-account principals notwithstanding local Allow. The present issue is a root principal tries to use prohibited organization APIs but remains allowed by account permissions; it is more directly addressed by Ensure applicable SCP deny also covers member-account root principals. Member-account root is generally subject to SCP constraints.

The option Provide a read-only policy limited to necessary List and Describe actions addresses a separate condition: a role needs to discover resources without managing them. Read discovery can be separated from mutation permissions. The actual requirement is a root principal tries to use prohibited organization APIs but remains allowed by account permissions. Recommended corrective action: Ensure applicable SCP deny also covers member-account root principals. Member-account root is generally subject to SCP constraints.

The competing option Use organization-level SCP guardrails against prohibited logging changes would be useful when a development administrator attempts to disable audit logging in their account. SCP denies block member-account principals notwithstanding local Allow. The present issue is the management account is assumed to obey all attached SCPs; it is more directly addressed by Design separate management-account controls since SCPs do not restrict it. Management account is outside SCP permission limits.

The option Apply an SCP region guardrail with global-service exemptions addresses a separate condition: teams require prevention of nonapproved AWS Regions for supported resources. Region controls must avoid blocking globally scoped service APIs. The actual requirement is the management account is assumed to obey all attached SCPs. Recommended corrective action: Design separate management-account controls since SCPs do not restrict it. Management account is outside SCP permission limits.

Ensure applicable SCP deny also covers member-account root principals would help if a root principal tries to use prohibited organization APIs but remains allowed by account permissions. Member-account root is generally subject to SCP constraints. That is not the symptom described here: the management account is assumed to obey all attached SCPs. The matching response is Design separate management-account controls since SCPs do not restrict it, because management account is outside SCP permission limits.

The option Use organization-level SCP guardrails against prohibited logging changes addresses a separate condition: a development administrator attempts to disable audit logging in their account. SCP denies block member-account principals notwithstanding local Allow. The actual requirement is a role needs to discover resources without managing them. Recommended corrective action: Provide a read-only policy limited to necessary List and Describe actions. Read discovery can be separated from mutation permissions.

Apply an SCP region guardrail with global-service exemptions would help if teams require prevention of nonapproved AWS Regions for supported resources. Region controls must avoid blocking globally scoped service APIs. That is not the symptom described here: a role needs to discover resources without managing them. The matching response is Provide a read-only policy limited to necessary List and Describe actions, because read discovery can be separated from mutation permissions.

For the alternative failure a root principal tries to use prohibited organization APIs but remains allowed by account permissions, the control Ensure applicable SCP deny also covers member-account root principals is relevant: member-account root is generally subject to SCP constraints. Here the evidence instead is a role needs to discover resources without managing them. The selected technical mechanism is Provide a read-only policy limited to necessary List and Describe actions: read discovery can be separated from mutation permissions.

The option Provide a read-only policy limited to necessary List and Describe actions addresses a separate condition: a role needs to discover resources without managing them. Read discovery can be separated from mutation permissions. The actual requirement is teams require prevention of nonapproved AWS Regions for supported resources. Recommended corrective action: Apply an SCP region guardrail with global-service exemptions. Region controls must avoid blocking globally scoped service APIs.

Ensure applicable SCP deny also covers member-account root principals would help if a root principal tries to use prohibited organization APIs but remains allowed by account permissions. Member-account root is generally subject to SCP constraints. That is not the symptom described here: teams require prevention of nonapproved AWS Regions for supported resources. The matching response is Apply an SCP region guardrail with global-service exemptions, because region controls must avoid blocking globally scoped service APIs.

Use organization-level SCP guardrails against prohibited logging changes solves a different operational problem where a development administrator attempts to disable audit logging in their account. SCP denies block member-account principals notwithstanding local Allow. It does not directly address teams require prevention of nonapproved AWS Regions for supported resources. The case calls for Apply an SCP region guardrail with global-service exemptions, since region controls must avoid blocking globally scoped service APIs.