SAA-C03 Design Secure Architectures Practice Question
A CI/CD pipeline needs to deploy to your production environment. Security requires that the pipeline uses temporary credentials (not long-lived access keys) and only has permissions to read a specific set of parameters from AWS Systems Manager Parameter Store and write application logs to CloudWatch Logs. What is the best AWS approach?
⚠ Common exam trap
Watch out — candidates often choose Option A or D because they focus on credential storage rather than the fundamental requirement for temporary credentials, or they may confuse IAM groups with roles, thinking a group can be used for cross-account access without understanding that groups only apply to IAM users within the same account.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an IAM role in the production account, grant least-privilege policies, and let the CI assume it using STS AssumeRole.
It uses an IAM role with least-privilege policies that the CI/CD pipeline can assume via AWS STS AssumeRole, generating temporary credentials that automatically expire. This eliminates the need for long-lived access keys and adheres to the security requirement of using temporary credentials. The role's policies can be scoped to exactly read specific parameters from Systems Manager Parameter Store and write logs to CloudWatch Logs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an IAM user for the pipeline and store access keys in the CI system.
Why it's wrong here
IAM users typically rely on long-lived access keys, which you need to avoid by requirement.
- ✓
Create an IAM role in the production account, grant least-privilege policies, and let the CI assume it using STS AssumeRole.
Why this is correct
IAM roles with STS provide temporary credentials and allow least-privilege permissions via attached policies.
- ✗
Attach the required permissions to an IAM group and add the pipeline’s principal to that group directly.
Why it's wrong here
Groups apply to IAM identities using credentials, but this does not inherently provide temporary STS credentials.
- ✗
Use AWS KMS to encrypt the pipeline’s access keys and store the ciphertext in the CI system.
Why it's wrong here
Encrypting access keys does not replace the need for long-lived credentials and does not use STS.
Go deeper
Related to this question
About these practice questions
One of 302 original SAA-C03 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.