A CI/CD pipeline needs to deploy to your production environment. Security requires that the pipeline uses temporary credentials (not long-lived access keys) and only has permissions to read a specific set of parameters from AWS Systems Manager Parameter Store and write application logs to CloudWatch Logs. What is the best AWS approach?

Create an IAM user for the pipeline and store access keys in the CI system.

IAM users typically rely on long-lived access keys, which you need to avoid by requirement.

Attach the required permissions to an IAM group and add the pipeline’s principal to that group directly.

Groups apply to IAM identities using credentials, but this does not inherently provide temporary STS credentials.

Use AWS KMS to encrypt the pipeline’s access keys and store the ciphertext in the CI system.

Encrypting access keys does not replace the need for long-lived credentials and does not use STS.

What does this SAA-C03 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Create an IAM role in the production account, grant least-privilege policies, and let the CI assume it using STS AssumeRole. — Using an IAM role assumed by the pipeline via STS meets both security goals: it removes long-lived access keys and provides short-lived, auditable sessions. You can attach a least-privilege permissions policy to the role that allows only the required Parameter Store read actions for a specific path or parameter ARNs, plus CloudWatch Logs write actions. The CI pipeline then calls sts:AssumeRole, obtaining temporary credentials scoped to that role. Why others are wrong: An IAM user requires long-lived access keys, which violates the temporary-credential requirement. Using an IAM group alone still depends on credential types and does not give the session-based isolation that STS provides. KMS can protect secrets, but encrypting access keys does not change their long-lived nature or ensure the pipeline gets least-privilege, temporary STS sessions.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.