SAP-C02 Question 147

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B1

  When granting external parties access to your AWS account, use cross-account IAM roles with a trust policy for their AWS account and an external ID to prevent the confused deputy problem. Attach least-privilege permissions (e.g., ReadOnlyAccess). This avoids sharing permanent credentials and aligns with AWS security best practices.

• 1

  https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user.html

• 1

  To create an IAM role that trusts the auditors' AWS account, you can do the following: Sign in to the AWS Management Console and open the IAM console. In the navigation pane, choose Roles, and then choose Create role. Choose the Custom trust policy role type. In the Custom trust policy section, enter or paste the following trust policy: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::<auditor-account-id>:root" }, "Action": "sts:AssumeRole" } ] }