Exam AWS Certified Solutions Architect - Associate SAA-C03 topic 1 question 387 discussion

Exam question from Amazon's AWS Certified Solutions Architect - Associate SAA-C03

Question #: 387
Topic #: 1

[All AWS Certified Solutions Architect - Associate SAA-C03 Questions]

A new employee has joined a company as a deployment engineer. The deployment engineer will be using AWS CloudFormation templates to create multiple AWS resources. A solutions architect wants the deployment engineer to perform job activities while following the principle of least privilege.

Which combination of actions should the solutions architect take to accomplish this goal? (Choose two.)

A. Have the deployment engineer use AWS account root user credentials for performing AWS CloudFormation stack operations.
B. Create a new IAM user for the deployment engineer and add the IAM user to a group that has the PowerUsers IAM policy attached.
C. Create a new IAM user for the deployment engineer and add the IAM user to a group that has the AdministratorAccess IAM policy attached.
D. Create a new IAM user for the deployment engineer and add the IAM user to a group that has an IAM policy that allows AWS CloudFormation actions only.
E. Create an IAM role for the deployment engineer to explicitly define the permissions specific to the AWS CloudFormation stack and launch stacks using that IAM role.

Show Suggested Answer

Suggested Answer: DE 🗳️

by [deleted] at March 10, 2023, 3:46 p.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

truongtx8

Highly Voted 11 months, 1 week ago

Selected Answer: DE

The answers inside the question: CloudFormation. A is exlucded since root account is never a choice for the principle of least privilege. D, E left are the correct ones.

upvoted 5 times

...

aragon_saa

Highly Voted 1 year, 9 months ago

D, E https://www.examtopics.com/discussions/amazon/view/46428-exam-aws-certified-solutions-architect-associate-saa-c02/

upvoted 5 times

mwwt2022

11 months, 4 weeks ago

thank you my friend

upvoted 2 times

...

awsgeek75

Most Recent 11 months, 2 weeks ago

Selected Answer: DE

ABC are just giving too much access so CD are logical choices

upvoted 3 times

...

TariqKipkemei

1 year, 2 months ago

Selected Answer: DE

Create a new IAM user for the deployment engineer and add the IAM user to a group that has an IAM policy that allows AWS CloudFormation actions only. Create an IAM role for the deployment engineer to explicitly define the permissions specific to the AWS CloudFormation stack and launch stacks using that IAM role.

upvoted 3 times

...

Guru4Cloud

1 year, 3 months ago

Selected Answer: DE

The two actions that should be taken to follow the principle of least privilege are: D) Create a new IAM user for the deployment engineer and add the IAM user to a group that has an IAM policy that allows AWS CloudFormation actions only. E) Create an IAM role for the deployment engineer to explicitly define the permissions specific to the AWS CloudFormation stack and launch stacks using that IAM role. The principle of least privilege states that users should only be given the minimal permissions necessary to perform their job function.

upvoted 4 times

...

alexandercamachop

1 year, 6 months ago

Selected Answer: DE

Option D, creating a new IAM user and adding them to a group with an IAM policy that allows AWS CloudFormation actions only, ensures that the deployment engineer has the necessary permissions to perform AWS CloudFormation operations while limiting access to other resources and actions. This aligns with the principle of least privilege by providing the minimum required permissions for their job activities. Option E, creating an IAM role with specific permissions for AWS CloudFormation stack operations and allowing the deployment engineer to assume that role, is another valid approach. By using an IAM role, the deployment engineer can assume the role when necessary, granting them temporary permissions to perform CloudFormation actions. This provides a level of separation and limits the permissions granted to the engineer to only the required CloudFormation operations.

upvoted 3 times

...