SAP-C03 practice question: Least privilege, cross-account roles, ABAC and IAM Roles Anywhere (1 of 2)
Security, Compliance, and Governance A free question from our original SAP-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A streaming company hires a monitoring vendor that runs its SaaS platform from the vendor's own AWS account. The vendor needs to read CloudWatch metrics and alarms from the company's 30 production accounts.
The company's security policy forbids long-lived credentials for third parties, and access must be limited to the read-only actions that the vendor's platform calls. The company must also stop another of the vendor's customers from tricking the platform into reaching the company's accounts.
Which solution meets these requirements?
Choose one answer.
AA. In each production account, create a role with a read-only CloudWatch policy that trusts the vendor's account and requires the unique external ID that the vendor assigned to the company.
BB. In each production account, create an IAM user for the vendor with a read-only CloudWatch policy, and send the access key pair to the vendor through the company's secrets vault for rotation every 90 days.
CC. In each production account, attach the AdministratorAccess policy to a role that trusts the vendor, and rely on CloudTrail alerts to spot any misuse by the vendor.
DD. Create a service control policy in the organization that allows the vendor's account to call CloudWatch read actions in every production account.
Show the answer and explanation
Answer: A
A. Right: Correct. A cross-account role gives the vendor temporary credentials with read-only permissions. The external ID ties the role to the company's own configuration in the vendor's platform, so another customer's request cannot use it, which prevents the confused deputy problem.
B. Wrong: The IAM user's access keys are long-lived and must be rotated by hand. The policy meets the read-only need, but the design breaks the rule against long-lived third-party credentials.
C. Wrong: Administrator access is far broader than metrics and alarms need. Alerts only report misuse after it happens, and they do not limit what the vendor can do.
D. Wrong: An SCP limits what principals can do and does not grant any permissions by itself. The vendor would still have no role or credentials to make the calls.
Explanation
A cross-account role with a read-only policy and an external ID gives temporary, scoped access and blocks the confused-deputy case. Long-lived IAM user keys break the credential rule, administrator access is far too broad, and an SCP grants nothing.
Want more on Least privilege, cross-account roles, ABAC and IAM Roles Anywhere? The 5 full-length practice sets have 10 more Least privilege, cross-account roles, ABAC and IAM Roles Anywhere questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →