A CI/CD system creates an IAM role (CICDRole) used for deployments. Your organization uses IAM permission boundaries to prevent developers from granting themselves higher privileges. After an incident, you discover that CICDRole can perform unintended IAM actions because the role’s identity policy includes broad permissions. Which change most directly ensures permission boundaries continue to restrict CICDRole regardless of what is later added to the role’s identity policies?

Remove the permission boundary from CICDRole so that only the identity policy controls access.

Removing the permission boundary removes the guardrail. If the identity policy is overly broad, nothing will cap the effective permissions, allowing the unintended IAM actions.

Add an identity-policy deny for iam:CreatePolicy and iam:UpdateRole on all resources.

Identity-policy denies can be incomplete or bypassed indirectly through other actions/permissions or policy changes. They also depend on correct identity policy maintenance over time, whereas permission boundaries provide a centralized maximum cap for the role.

Rely on CloudTrail alerts to stop deployments from performing IAM changes after the fact.

CloudTrail is a detective control; it does not stop or block IAM actions. Permission boundaries must be enforced during authorization, not after the event.

What does this SAA-C03 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Ensure CICDRole is created with the required permissions boundary ARN, and verify that the boundary policy does not allow the unintended IAM actions. — Create/maintain CICDRole with the appropriate permissions boundary ARN and ensure that the boundary policy explicitly limits the allowed permissions. Permission boundaries are enforced at authorization time by intersecting the role’s identity policy with the boundary policy, so expanded identity policies cannot grant permissions beyond what the boundary allows. This directly addresses the privilege escalation risk. Removing the boundary removes the enforcement mechanism. Identity-policy denies are not as robust as boundaries for preventing future privilege expansion. CloudTrail alerts cannot prevent unauthorized actions because they only detect activity after it occurs.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.