Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
AWS Certified Solutions Architect - Professional · AWS
Select 3 answers.
This question asks for 3 answers, but our data marks only 1. Compare with the community discussion below for the full answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
A. SCP for Account A ❌ SCPs don’t grant permissions; they only limit the maximum permissions. If there’s no deny, you don’t need to change SCPs for assume role. D. Identity-based policy on user in Account B ❌ Wrong because the user doesn’t exist in Account B. F. Session policy ❌ Session policies are optional. They can restrict permissions during a session but are not required to allow assume role.
SCP does not grant permission it's a guardrail (it's a deny policy always) so the option is wrongly worded!
✅C. Configure the identity-based policy on the user in Account A to allow the action. The IAM user in Account A needs permission to assume the role in Account B. This is done by attaching an identity-based policy that allows the sts:AssumeRole action on the target role in Account B. ✅ E. Configure the trust policy on the target role in Account B to allow the action. The IAM role in Account B must trust the user from Account A. This is done by adding a trust policy to the role, specifying Account A’s user or a specific IAM principal from Account A. ✅ A. Configure the SCP for Account A to allow the action. Service Control Policies (SCPs) act as guardrails at the AWS Organizations level. If there is an SCP that denies cross-account role assumption, it must be modified to allow sts:AssumeRole for Account A.