SCS-C03 practice question: Fine-grained app authorization (Amazon Verified Permissions)
Identity and Access Management A free question from our original SCS-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A property management software company runs a multi-tenant app for about 4,000 property managers. Each tenant's data is kept separate, and a user can hold several roles inside one tenant, such as owner, manager, or viewer.
Authorization rules change often as customers ask for new roles, and the team does not want a code deployment for each change. Every request must check whether the user's role in that tenant allows the action on that specific property. No user may see another tenant's properties, even if the application code has a bug.
Which solution meets these requirements?
Choose one answer.
AA. Write the authorization checks as if statements in the application code, with one block for each role and action. Redeploy the service whenever a role or rule changes, and rely on code review to catch tenant scoping mistakes.
BB. Keep Cedar policies in an Amazon Verified Permissions policy store that require the principal's tenant to match the property's tenant. The app calls IsAuthorized on each request, and admins edit policies without a deployment.
CC. Store each user's tenant and roles as Amazon Cognito groups, and let the API Gateway authorizer decide access from those groups. The groups alone can express the tenant, role and property relationships that the app needs.
DD. Create an IAM role for each tenant, and attach IAM policies that allow actions on the property ARNs for the users who belong to that tenant. Use IAM condition keys to match each user's role to the requested action.
Show the answer and explanation
Answer: B
A. Wrong: Code-based checks depend on every developer getting tenant scoping right, which the requirement forbids. Every rule change also needs a deployment, which the team wants to avoid.
B. Right: Correct. Cedar policies can compare tenant and role attributes against each property, and the policy store can change without a code deployment. The check runs on every request, so a query built with the wrong tenant is still denied. Learn more: What is Amazon Verified Permissions? (opens in a new tab)
C. Wrong: Groups carry role membership, but they cannot express that a property belongs to one tenant and that a role applies only to particular properties. The app would still need per-resource logic, so groups alone do not meet the requirement.
D. Wrong: IAM can separate tenants, but it needs roles and policies that grow with each tenant and property, and IAM quotas limit how many roles an account can hold. IAM policies also cannot model a role that applies only to some properties cleanly.
Explanation
Verified Permissions evaluates Cedar policies outside the application code, so rule changes need no deployment, and tenant checks run on every request. Code-based checks rely on every developer, Cognito groups cannot express property ownership, and per-tenant IAM roles do not scale. Only the policy store meets all three constraints.
Want more on Fine-grained app authorization (Amazon Verified Permissions)? The 5 full-length practice sets have 6 more Fine-grained app authorization (Amazon Verified Permissions) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →