SAP-C02 Question 74

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose C1

  To enforce a policy where engineers can only provision approved resources via AWS CloudFormation, assign engineers IAM policies that only permit CloudFormation actions, and use a separate IAM service role for CloudFormation that allows only approved resource types. This setup ensures engineers cannot bypass restrictions, and provisioning is limited to approved services defined by the service role.

• 1

  C. Update the IAM policy for the engineers’ IAM role with permissions to only allow AWS CloudFormation actions. Create a new IAM policy with permission to provision approved resources, and assign the policy to a new IAM service role. Assign the IAM service role to AWS CloudFormation during stack creation.

• Chose C1

  C, use the IAM service role to execute the stack