Question 1,322 of 724
Cross-Account IAM Role Trust Policy for AWS Organizations
A company is designing a multi-account strategy using AWS Organizations. They want to enable cross-account access for developers using IAM roles. Each developer has an IAM user in the 'developers' account. The 'production' account has an IAM role 'AdminRole' that can be assumed by the 'developers' account. Which trust policy should be attached to 'AdminRole'?
Quick Answer
The correct trust policy for the AdminRole in the production account uses the developers account’s root ARN (arn:aws:iam::123456789012:root) as the Principal, because this delegates trust to the entire developers account rather than to a specific user or role. When a developer’s IAM user in that account calls sts:AssumeRole, AWS first checks this cross-account IAM role trust policy; by specifying the root ARN, you allow any identity within the developers account to attempt the role assumption, while the individual user’s ability to actually assume the role is then governed by a separate IAM policy attached to that user or group. On the AWS Certified Developer Associate DVA-C02 exam, this concept tests your understanding that trust policies are account-level permissions, not user-level—a common trap is mistakenly listing a specific user ARN, which would break cross-account access for other developers. Memory tip: think “root for the account, policy for the user”—the trust policy opens the door to the whole account, and the user’s IAM policy decides who walks through.
⚠ Common exam trap
It's easy for candidates to confuse the trust policy's Principal with the resource being accessed, mistakenly specifying the role's own ARN (Option D) or limiting to specific users (Option C), instead of using the root ARN of the trusted account to allow any authorized entity in that account to assume the role.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:root"},"Action":"sts:AssumeRole"}]} where 123456789012 is the developers account ID.
The trust policy on the 'AdminRole' in the production account must allow the entire 'developers' account (using its root ARN) to assume the role. When an IAM user in the developers account calls sts:AssumeRole, AWS evaluates the trust policy; specifying the root ARN of the developers account (arn:aws:iam::123456789012:root) delegates trust to the entire account, and the individual user's permissions are then controlled by an IAM policy attached to the user or a group that grants sts:AssumeRole for this role.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:root"},"Action":"sts:AssumeRole"}]} where 123456789012 is the developers account ID.
Why this is correct
The root user of the account is used to allow all IAM users/roles in that account to assume the role.
- ✗
{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"ec2.amazonaws.com"},"Action":"sts:AssumeRole"}]}
Why it's wrong here
This allows EC2 service, not an IAM user from another account.
- ✗
{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:user/*"},"Action":"sts:AssumeRole"}]}
Why it's wrong here
Using user/* is not valid; the principal must be an account root or a specific IAM entity.
- ✗
{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:role/AdminRole"},"Action":"sts:AssumeRole"}]}
Why it's wrong here
That ARN refers to a role in the same account, not the developers account.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DVA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A developer needs to allow an IAM user in a different AWS account to assume a role in the developer's account. The role has permissions to access an S3 bucket. Which policy is required in the developer's account to enable this cross-account access?
medium- ✓ A.An IAM role with a trust policy that allows the external account's root user or specific IAM users/roles to assume the role
- B.An S3 bucket policy granting access to the external account
- C.An IAM user policy in the external account allowing sts:AssumeRole
- D.An AWS Organizations service control policy allowing cross-account access
Why A: Cross-account IAM role access requires a trust policy attached to the role in the developer's account. This trust policy specifies the external AWS account ID (or specific IAM users/roles in that account) as the principal, allowing them to call sts:AssumeRole. Once the role is assumed, the developer's account grants the necessary S3 permissions via the role's permissions policy.
Last reviewed: Jun 24, 2026
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.