SCS-C03 practice question: Attribute-based and role-based access control (tags, session tags)

Identity and Access Management A free question from our original SCS-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

A research hospital runs a shared data platform with one S3 bucket, research-data, that holds a prefix for each department, such as research-data/cardiology/. Researchers sign in through a SAML identity provider, which sends a Department attribute for each person.

The data office wants one shared analyst role for all researchers, so that it does not maintain a role for each department. A researcher must be able to read only their own department's prefix, and adding a new department must need no policy edits.

Which solution meets these requirements?

Choose one answer.

A. Create one role for each department, with a policy that allows only its prefix. Have the identity provider map each researcher to the role for their department, and add a role whenever a new department joins.
B. Map the Department attribute to the role session name, and add a bucket policy statement for each department that allows only sessions with that name to read its prefix.
C. Pass the Department attribute as a session tag, and allow sts:TagSession in the role trust policy. Allow reads on research-data/${aws:PrincipalTag/Department}/* in the role policy.
D. Create one S3 access point for each department prefix, and give the shared role access to every access point. The access point names carry the department, so access follows each prefix.

Show the answer and explanation

Answer: C

A. Wrong: This works, but it creates a role for each department and a new role for every new department. The data office asked for one shared role, so this option misses the stated requirement.
B. Wrong: Session names can carry the department, but each department needs its own bucket policy statement. Adding a department then needs a policy edit, which the data office wants to avoid.
C. Right: Correct. The identity provider attribute becomes a session tag, and IAM fills it into the resource ARN on every request, so each researcher reaches only their own prefix. A new department works without a policy edit, and the trust policy must allow session tagging. Learn more: Passing session tags in AWS STS (opens in a new tab)
D. Wrong: Access points do not check a person's department, so the shared role could read through every access point. Each new department would also need a new access point and policy.

Explanation

Attribute-based access control passes the department from the identity provider as a session tag, and a policy variable puts that tag into the allowed prefix on every request. One shared role then works for every department with no policy edits. Per-department roles, per-department statements and access points each fail a stated requirement.

SCS-C03 practice question: Attribute-based and role-based access control (tags, session tags)

Explanation

Study

Keep practicing