Amazon AWS Certified Solutions Architect - Professional SAP-C02 Bundle

Grant the instance role permissions and configure the destination bucket resource policy as required solves the related scenario A service running on EC2 needs to access an S3 bucket in another account; cross-account access must satisfy both principal authorization and resource-side trust or policy.

Although Configure a narrowly scoped cross-account IAM role trusted by the security account and use STS AssumeRole can be valid when An auditing application in a security account must list resources in member accounts without long-lived keys, it targets a different technical condition. Temporary role sessions avoid distributing persistent credentials across accounts.

Remove the organizational SCP deny if authorized while preserving least-privilege IAM controls would address a different requirement: An assumed role's policy allows an action but the member account SCP explicitly denies it. SCP denies form a permissions ceiling that IAM allows cannot override.

Although Use time-bound privileged access workflows and short-lived role sessions can be valid when A privileged operator should receive AWS access only during an approved short maintenance window, it targets a different technical condition. Temporary elevated roles reduce standing administrative access exposure.

This alternative, Use IAM Identity Center permission sets assigned to groups and target accounts, is appropriate when A global workforce needs consistent permission bundles across many AWS accounts. Permission sets standardize provisioned account roles for group-based access.

For the separate situation A mobile application needs direct federated end-user authentication for its own customers, not AWS workforce console login, Use Amazon Cognito user pools and supported federation for application identities could be useful. Cognito user pools provide application user sign-in rather than workforce account permission sets.

Integrate AWS IAM Identity Center with the corporate identity provider would address a different requirement: Workforce users must sign in with an existing corporate IdP rather than receive individual IAM users. Identity Center federates workforce access and centrally assigns account permission sets.

This alternative, Use IAM Identity Center permission sets assigned to groups and target accounts, is appropriate when A global workforce needs consistent permission bundles across many AWS accounts. Permission sets standardize provisioned account roles for group-based access.

For the separate situation A mobile application needs direct federated end-user authentication for its own customers, not AWS workforce console login, Use Amazon Cognito user pools and supported federation for application identities could be useful. Cognito user pools provide application user sign-in rather than workforce account permission sets.

For the separate situation An SAML-authenticated employee needs temporary console access to a delegated AWS role, Configure standards-based SAML federation with scoped role trust and attribute mapping could be useful. SAML identity assertions can authorize temporary AWS role sessions.

Use time-bound privileged access workflows and short-lived role sessions solves the related scenario A privileged operator should receive AWS access only during an approved short maintenance window; temporary elevated roles reduce standing administrative access exposure.

Although Integrate AWS IAM Identity Center with the corporate identity provider can be valid when Workforce users must sign in with an existing corporate IdP rather than receive individual IAM users, it targets a different technical condition. Identity Center federates workforce access and centrally assigns account permission sets.

For the separate situation A privileged operator should receive AWS access only during an approved short maintenance window, Use time-bound privileged access workflows and short-lived role sessions could be useful. Temporary elevated roles reduce standing administrative access exposure.

Integrate AWS IAM Identity Center with the corporate identity provider solves the related scenario Workforce users must sign in with an existing corporate IdP rather than receive individual IAM users; identity Center federates workforce access and centrally assigns account permission sets.

Although Use IAM Identity Center permission sets assigned to groups and target accounts can be valid when A global workforce needs consistent permission bundles across many AWS accounts, it targets a different technical condition. Permission sets standardize provisioned account roles for group-based access.

Configure standards-based SAML federation with scoped role trust and attribute mapping solves the related scenario An SAML-authenticated employee needs temporary console access to a delegated AWS role; sAML identity assertions can authorize temporary AWS role sessions.

Although Use IAM Identity Center permission sets assigned to groups and target accounts can be valid when A global workforce needs consistent permission bundles across many AWS accounts, it targets a different technical condition. Permission sets standardize provisioned account roles for group-based access.

Use Amazon Cognito user pools and supported federation for application identities would address a different requirement: A mobile application needs direct federated end-user authentication for its own customers, not AWS workforce console login. Cognito user pools provide application user sign-in rather than workforce account permission sets.

Enable AWS KMS automatic rotation for an eligible symmetric customer managed key would address a different requirement: A service team wants automatic yearly key material rotation without changing ciphertext references. KMS retains prior key material so old ciphertext remains decryptable after rotation.

For the separate situation A multi-Region application needs matching cryptographic key identities and interoperable ciphertext across Regions, Use AWS KMS multi-Region primary and replica keys with carefully governed key policies could be useful. Related multi-Region keys share key material and key identifiers for cross-Region cryptographic operations.

Choose supported client-side encryption or external key management per the requirement solves the related scenario A legacy data export must use encryption keys held outside AWS KMS and independently managed; client-side encryption can preserve direct control of plaintext and key lifecycle outside KMS.

This alternative, Use AWS KMS multi-Region primary and replica keys with carefully governed key policies, is appropriate when A multi-Region application needs matching cryptographic key identities and interoperable ciphertext across Regions. Related multi-Region keys share key material and key identifiers for cross-Region cryptographic operations.

For the separate situation A legacy data export must use encryption keys held outside AWS KMS and independently managed, Choose supported client-side encryption or external key management per the requirement could be useful. Client-side encryption can preserve direct control of plaintext and key lifecycle outside KMS.

Configure SSE-KMS with a customer managed KMS key and appropriate CloudTrail auditing solves the related scenario A sensitive S3 bucket should use customer-controlled key permissions and usage auditing; sSE-KMS integrates object encryption with key-policy control and KMS API logging.

For the separate situation A multi-Region application needs matching cryptographic key identities and interoperable ciphertext across Regions, Use AWS KMS multi-Region primary and replica keys with carefully governed key policies could be useful. Related multi-Region keys share key material and key identifiers for cross-Region cryptographic operations.

Grant applications access through stable roles and preserve the KMS key and policy solves the related scenario Data encrypted with a customer managed KMS key must remain decryptable after an employee leaves the team; kMS access is evaluated against key and IAM policies, not tied to an employee's existence.

Enable AWS KMS automatic rotation for an eligible symmetric customer managed key would address a different requirement: A service team wants automatic yearly key material rotation without changing ciphertext references. KMS retains prior key material so old ciphertext remains decryptable after rotation.

Grant applications access through stable roles and preserve the KMS key and policy solves the related scenario Data encrypted with a customer managed KMS key must remain decryptable after an employee leaves the team; kMS access is evaluated against key and IAM policies, not tied to an employee's existence.

Although Enable AWS KMS automatic rotation for an eligible symmetric customer managed key can be valid when A service team wants automatic yearly key material rotation without changing ciphertext references, it targets a different technical condition. KMS retains prior key material so old ciphertext remains decryptable after rotation.

This alternative, Choose supported client-side encryption or external key management per the requirement, is appropriate when A legacy data export must use encryption keys held outside AWS KMS and independently managed. Client-side encryption can preserve direct control of plaintext and key lifecycle outside KMS.

Although Configure SSE-KMS with a customer managed KMS key and appropriate CloudTrail auditing can be valid when A sensitive S3 bucket should use customer-controlled key permissions and usage auditing, it targets a different technical condition. SSE-KMS integrates object encryption with key-policy control and KMS API logging.

Use AWS KMS multi-Region primary and replica keys with carefully governed key policies would address a different requirement: A multi-Region application needs matching cryptographic key identities and interoperable ciphertext across Regions. Related multi-Region keys share key material and key identifiers for cross-Region cryptographic operations.

This alternative, Grant applications access through stable roles and preserve the KMS key and policy, is appropriate when Data encrypted with a customer managed KMS key must remain decryptable after an employee leaves the team. KMS access is evaluated against key and IAM policies, not tied to an employee's existence.