SCS-C03 practice question: Least-privilege policies (permissions boundaries, session policies, conditions)
Identity and Access Management A free question from our original SCS-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A SaaS startup lets its developers create IAM roles for new Lambda functions and containers. Security wants developers to create their own roles, but no role may ever hold more permissions than the team's approved set.
The startup runs one development account, and its engineers ship new functions every week, so the control must not slow releases. Developers must not be able to remove or change that limit, and the approach must keep working when new AWS services are added to the approved set later.
Which solution meets these requirements?
Choose one answer.
AA. Give developers the AdministratorAccess policy, and turn on AWS CloudTrail alerts for IAM role changes. The security team will review the alerts each morning and remove any role that exceeds the approved set.
BB. Have developers request each role from the operations team through a ticket, and have operations create the role from a fixed template. Developers never create IAM roles directly in the account.
CC. Attach a service control policy to the development account that denies iam:CreateRole for all principals, including the deployment pipeline. Developers then request roles from the security team.
DD. Allow developers to create roles only when a managed permissions boundary that lists the approved services is attached, and deny any change to that boundary policy.
Show the answer and explanation
Answer: D
A. Wrong: Alerts detect problems after they happen, and developers would already hold any permission they need to grant themselves. The requirement is that no role can exceed the approved set, which needs a preventive control.
B. Wrong: A fixed template limits what each role can do, but every new role waits in a queue. This adds overhead for each Lambda and container change, and developers cannot self-serve as the startup wants.
C. Wrong: The deny stops role creation for developers, but it also blocks the deployment pipeline that creates roles for functions and containers. The startup wants developers to self-serve, so this option breaks the workflow.
D. Right: Correct. The boundary caps what any new role can ever do, whatever its identity policy says, and the deny on the boundary keeps developers from lifting the limit. Developers still create roles themselves, and a new service only needs the boundary policy updated. Learn more: Permissions boundaries for IAM entities (opens in a new tab)
Explanation
A permissions boundary sets the maximum permissions a role can have, and an IAM condition can require every role a developer creates to carry it. Denying changes to the boundary keeps the limit in place. Detection after the fact, ticket queues, and a blanket deny each miss one of the requirements.
Want more on Least-privilege policies (permissions boundaries, session policies, conditions)? The 5 full-length practice sets have 6 more Least-privilege policies (permissions boundaries, session policies, conditions) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →