ExamPark
Course menuSAP-C03

Exams / SAP-C03 / Least privilege, cross-account roles, ABAC and IAM Roles Anywhere / Question 2

SAP-C03 practice question: Least privilege, cross-account roles, ABAC and IAM Roles Anywhere (2 of 2)

Security, Compliance, and Governance A free question from our original SAP-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

A streaming service has about 400 developers in 30 product teams. Every team's EC2 instances carry a team tag, and the platform team does not want to write or maintain a separate IAM policy for each team.

Developers must start and stop only the EC2 instances that carry their own team's tag. They may also create IAM roles for their applications, but no role they create may grant more permissions than the platform team allows, and they must not be able to remove that limit from the roles they create.

Which TWO policy designs meet these requirements? (Choose two.)

Choose two answers.

  1. A. Write one attribute-based access control policy that allows ec2:StartInstances and ec2:StopInstances when the instance's team tag matches the caller's team principal tag.
  2. B. Create one IAM group per team with a managed policy that lists the ARN of every instance that team owns, and add the team's developers to that group.
  3. C. Give developers AdministratorAccess, and rely on CloudTrail alerts and a monthly review to find roles that exceed the platform's limits.
  4. D. Allow developers to create roles only when the iam:PermissionsBoundary condition key equals the platform's boundary policy ARN, and deny them iam:DeleteRolePermissionsBoundary and any change to the boundary policy itself.
  5. E. Add an explicit deny for iam:CreateRole to every developer role, and have the platform team create each role on request through a ticket.
Show the answer and explanation

Answers: A, D

  • A. Right: Correct. The condition compares the instance's tag with the caller's own team tag, so one policy covers all 30 teams and new instances need no policy change. The developer can act only on their team's instances.
  • B. Wrong: The policy must be edited for every instance launch or retirement, which is the maintenance the platform team wants to avoid. It also does not follow the tags the teams already use.
  • C. Wrong: Alerts and reviews detect over-permissioned roles after the fact and do not stop developers from creating them. Administrator access also allows changes to any team's instances.
  • D. Right: Correct. A permissions boundary caps the permissions of each role developers create, and the conditions stop them from creating a role without it. Denying changes to the boundary keeps the limit in place on the roles they create.
  • E. Wrong: This stops the self-service need, since developers would wait on tickets for every application role. The requirement is for developers to create roles within the boundary, not to be blocked from doing so.

Explanation

Attribute-based access control scales one policy across tagged resources, and a permissions boundary caps every role developers create while the boundary itself stays locked. Per-team groups, administrator access and blanket role denials each miss a stated requirement.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free SAP-C03 practice examPractice Least privilege, cross-account roles, ABAC and IAM Roles AnywhereAll Least privilege, cross-account roles, ABAC and IAM Roles Anywhere questions

Want more on Least privilege, cross-account roles, ABAC and IAM Roles Anywhere? The 5 full-length practice sets have 10 more Least privilege, cross-account roles, ABAC and IAM Roles Anywhere questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets