Temporary Credentials for CI/CD Pipelines
A CI/CD pipeline needs to deploy to your production environment. Security requires that the pipeline uses temporary credentials (not long-lived access keys) and only has permissions to read a specific set of parameters from AWS Systems Manager Parameter Store and write application logs to CloudWatch Logs. What is the best AWS approach?
Quick Answer
An IAM role assumed via STS is the right approach because it satisfies the two security requirements simultaneously by design: STS AssumeRole issues temporary, automatically expiring credentials rather than the long-lived access keys the scenario explicitly wants avoided, and because the role is a distinct IAM identity, it can be attached to a least-privilege policy that grants only the specific actions needed, reading defined parameters from Systems Manager Parameter Store and writing logs to CloudWatch Logs, and nothing beyond that. This is a meaningfully different security posture than issuing the pipeline a long-lived IAM user's access keys, which would need to be stored somewhere in the CI system, rotated manually, and would keep working indefinitely if ever leaked; a role's credentials are short-lived and scoped to a session, so exposure is naturally time-limited even if something goes wrong. Scoping the attached policy narrowly to just the parameters and log group actually needed, rather than broader Parameter Store or CloudWatch permissions, is what fulfills least privilege rather than just temporary access. Whenever a scenario asks for an automated system like a CI/CD pipeline to access AWS resources with temporary, non-long-lived credentials and tightly scoped permissions, that combination of requirements is the signal to reach for an IAM role assumed through STS rather than static access keys.
⚠ Common exam trap
A common mix-up: candidates think IAM users with access keys are acceptable for automation, but the question explicitly requires temporary credentials, making the IAM role with STS AssumeRole the only correct approach.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an IAM role in the production account, grant least-privilege policies, and let the CI assume it using STS AssumeRole.
It uses an IAM role with least-privilege policies that the CI/CD pipeline can assume via AWS STS AssumeRole, providing temporary credentials that automatically expire. This avoids long-lived access keys and meets the security requirement of using temporary credentials. The role can be scoped to allow only reading specific parameters from Systems Manager Parameter Store and writing logs to CloudWatch Logs, adhering to the principle of least privilege.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an IAM user for the pipeline and store access keys in the CI system.
Why it's wrong here
IAM users typically rely on long-lived access keys, which you need to avoid by requirement.
When this WOULD be correct
This option would be correct if the question specified that the CI system cannot assume IAM roles (e.g., due to network restrictions or lack of STS support) and the security policy allows long-lived keys with regular rotation.
- ✓
Create an IAM role in the production account, grant least-privilege policies, and let the CI assume it using STS AssumeRole.
Why this is correct
IAM roles with STS provide temporary credentials and allow least-privilege permissions via attached policies.
- ✗
Attach the required permissions to an IAM group and add the pipeline’s principal to that group directly.
Why it's wrong here
Groups apply to IAM identities using credentials, but this does not inherently provide temporary STS credentials.
- ✗
Use AWS KMS to encrypt the pipeline’s access keys and store the ciphertext in the CI system.
Why it's wrong here
Encrypting access keys does not replace the need for long-lived credentials and does not use STS.
When this WOULD be correct
A scenario where the pipeline must use pre-existing long-lived access keys (e.g., legacy CI system that cannot assume roles) and the goal is to protect the keys at rest in the CI system's storage, with KMS encryption required by compliance.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SAA-C03 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create an IAM role in the production account, grant least-privilege policies, and let the CI assume it using STS AssumeRole.Correct answer▾
Why this is correct
IAM roles with STS provide temporary credentials and allow least-privilege permissions via attached policies.
✗Create an IAM user for the pipeline and store access keys in the CI system.Wrong answer — click to see why▾
Why this is wrong here
Option A uses long-lived access keys, violating the requirement for temporary credentials. IAM users with access keys are not temporary and increase security risk.
★ When this WOULD be the correct answer
This option would be correct if the question specified that the CI system cannot assume IAM roles (e.g., due to network restrictions or lack of STS support) and the security policy allows long-lived keys with regular rotation.
Why candidates choose this
Candidates may default to using IAM users and access keys because it's a familiar pattern for CI/CD integration, overlooking the explicit requirement for temporary credentials.
✗Use AWS KMS to encrypt the pipeline’s access keys and store the ciphertext in the CI system.Wrong answer — click to see why▾
Why this is wrong here
Using KMS to encrypt long-lived access keys does not eliminate the security risk of having permanent credentials; the pipeline still uses static keys, violating the requirement for temporary credentials.
★ When this WOULD be the correct answer
A scenario where the pipeline must use pre-existing long-lived access keys (e.g., legacy CI system that cannot assume roles) and the goal is to protect the keys at rest in the CI system's storage, with KMS encryption required by compliance.
Why candidates choose this
Candidates may think that encrypting the keys with KMS satisfies security best practices, overlooking that the core requirement is temporary credentials, not just encryption of static keys.
Analysis generated from the official SAA-C03blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAA-C03 question from scratch — 302 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SAA-C03
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A CI/CD pipeline needs to deploy to your production environment. Security requires that the pipeline uses temporary credentials (not long-lived access keys) and only has permissions to read a specific set of parameters from AWS Systems Manager Parameter Store and write application logs to CloudWatch Logs. What is the best AWS approach?
easy- A.Create an IAM user for the pipeline and store access keys in the CI system.
- ✓ B.Create an IAM role in the production account, grant least-privilege policies, and let the CI assume it using STS AssumeRole.
- C.Attach the required permissions to an IAM group and add the pipeline’s principal to that group directly.
- D.Use AWS KMS to encrypt the pipeline’s access keys and store the ciphertext in the CI system.
Why B: It uses an IAM role with least-privilege policies that the CI/CD pipeline can assume via AWS STS AssumeRole, generating temporary credentials that automatically expire. This eliminates the need for long-lived access keys and adheres to the security requirement of using temporary credentials. The role's policies can be scoped to exactly read specific parameters from Systems Manager Parameter Store and write logs to CloudWatch Logs.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.