Exam AWS Certified Solutions Architect - Associate SAA-C03 All Questions

View all questions & answers for the AWS Certified Solutions Architect - Associate SAA-C03 exam

Exam AWS Certified Solutions Architect - Associate SAA-C03 topic 1 question 870 discussion

Exam question from Amazon's AWS Certified Solutions Architect - Associate SAA-C03

Question #: 870
Topic #: 1

[All AWS Certified Solutions Architect - Associate SAA-C03 Questions]

A company has two AWS accounts: Production and Development. The company needs to push code changes in the Development account to the Production account. In the alpha phase, only two senior developers on the development team need access to the Production account. In the beta phase, more developers will need access to perform testing.

Which solution will meet these requirements?

A. Create two policy documents by using the AWS Management Console in each account. Assign the policy to developers who need access.
B. Create an IAM role in the Development account. Grant the IAM role access to the Production account. Allow developers to assume the role.
C. Create an IAM role in the Production account. Define a trust policy that specifies the Development account. Allow developers to assume the role.
D. Create an IAM group in the Production account. Add the group as a principal in a trust policy that specifies the Production account. Add developers to the group.

Show Suggested Answer

Suggested Answer: C 🗳️

by xBUGx at April 3, 2024, 11:52 p.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

FlyingHawk

7 months, 1 week ago

Selected Answer: C

1. Creating an IAM role in the Production account with a trust relationship to the Development account. 2. Grant the sts:AssumeRole permission to the specific developers (or groups) who need access to the Production account. 3. During the beta phase, you can easily add more developers to the IAM group or policy in the Development account that allows them to assume the role in the Production account. 4. In the Alpha phase, grant AssumeRole Permission to the groups of Two Senior Developers only

upvoted 3 times

...

LeonSauveterre

7 months, 3 weeks ago

Selected Answer: C

A - We need secure cross-account access between the Development and Production accounts. Option A did nothing about that. B - This setup violates the AWS best practice for cross-account access, which recommends creating roles in the account being accessed (aka Production env). C - As more developers need access, you can grant permissions in the Development account without modifying the role in Production. Also, access is granted through temporary credentials generated when the role is assumed, reducing the risk of long-term credential exposure. D - Groups cannot establish trust between accounts. It didn't provide any mechanism for Development account users to access the Production account.

upvoted 2 times

LeonSauveterre

7 months, 3 weeks ago

To "assume" a role in AWS means that you (a developer) temporarily take on the permissions associated with that role. This is done using the AWS Security Token Service (STS), which generates temporary credentials. Brief steps of option C: 1. Sets up a trust policy that allows entities from the Development account to assume the role. Attaches permissions for the required resources (in this case, access to specific services). 2. Attach an IAM policy to your user or role, allowing you to call "sts:AssumeRole". 3. Assume the role by doing this: aws sts assume-role \ --role-arn "arn:aws:iam::PRODUCTION_ACCOUNT_ID:role/ROLE_NAME" \ --role-session-name "MySessionName" 4. Use the temporary credentials to access the resources in the Production account during the session duration.

upvoted 1 times

...

AMEJack

8 months, 4 weeks ago

Selected Answer: C

It should be C, groups can't be used in trust policy.

upvoted 2 times

...

Mayank0502

1 year, 1 month ago

Selected Answer: D

answer should be D

upvoted 1 times

...

f07ed8f

1 year, 3 months ago

Selected Answer: C

https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.html

upvoted 3 times

...

TwinSpark

1 year, 3 months ago

Selected Answer: D

Weird question, but D is actually the only one that allow you to select which developer got access and when, so will go for D

upvoted 1 times

KennethNg923

1 year, 2 months ago

Agree, as C will let any developers assume the role without control

upvoted 1 times

KennethNg923

1 year, 2 months ago

I check here: https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.html, and yes it should be use IAM role, I correct my choice to C

upvoted 4 times

...

03beafc

1 year, 3 months ago

Selected Answer: A

you can't assign groups as principals, b and c don't specify only the senior devs, a is the only one that works here

upvoted 1 times

03beafc

1 year, 3 months ago

edit, none of these answers are right....

upvoted 1 times

...

Mikado211

1 year, 4 months ago

Selected Answer: D

If you want ALL the developers to assume the role in the production, then C using a trust policy to assume the role in production is perfect BUT You could allow users in development account to assume the role in production, but in the end you will maintain potentially a big trust policy depending of the total number of users. Here you want only some developers to connect to the production (others will follow without knowing if they all can connect and without knowing the number) so managing a separate group will give you a little more maintenance but will allow you to have different rights between the users. I'd say D

upvoted 1 times

...

802c4ff

1 year, 4 months ago

Selected Answer: C

https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.html

upvoted 3 times

...

xBUGx

1 year, 4 months ago

Selected Answer: D

i think D is better

upvoted 1 times

...