SAA-C03 practice question: IAM roles and policies (3 of 3)
Design Secure Architectures A free question from our original SAA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A consultancy has just opened a standalone AWS account, not part of AWS Organizations, for a new client project.
The root user's email address and password were set during sign-up. Three engineers will administer the account day to day, and a CI/CD pipeline will deploy to it.
The client's security policy requires the account to follow AWS guidance for protecting the root user.
Which TWO actions should the consultancy take? (Choose two.)
Choose two answers.
AA. Register an MFA device for the root user, and keep the root credentials where only a small, named group of people can use them.
BB. Attach an IAM policy to the root user that denies everything except billing actions, so that its power is limited if it is misused.
CC. Make sure the root user has no access keys, and give the pipeline its own IAM role with only the permissions it needs to deploy.
DD. Create access keys for the root user, store them in AWS Secrets Manager with rotation, and let the pipeline read them when it deploys.
EE. Share the root password with the three engineers through a password manager so that each of them can sign in for daily administration.
B. Wrong: You cannot attach identity-based policies or a permissions boundary to the root user. In an account that belongs to an organization, an SCP can restrict it, but this account is standalone. Protect the root user with MFA and by not using it instead. Learn more: Policies and permissions in IAM (opens in a new tab)
D. Wrong: Storing and rotating the keys does not change what they are: long-term credentials with unlimited access to the account. AWS guidance is not to create root access keys at all. Give the pipeline a least-privilege IAM role instead. Learn more: AWS Secrets Manager (opens in a new tab)
AWS root user guidance includes turning on MFA, keeping the credentials tightly controlled, never creating root access keys, and using separate identities with temporary credentials for daily work and automation. Identity-based policies cannot be attached to the root user; only SCPs or RCPs can limit it, and only inside AWS Organizations.
Want more on IAM roles and policies? The 5 full-length practice sets have 10 more IAM roles and policies questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →