A platform team lets application teams create IAM roles in member accounts through Infrastructure as Code. Security says every new role must stay within a centrally approved permission ceiling, even if someone later attaches broader managed policies or inline policies. Which control should be used to enforce that maximum permission set?

Use an AWS Organizations service control policy to grant the role all needed permissions directly.

An SCP sets the maximum permissions an account can use, but it does not define a per-role ceiling that survives future policy attachment changes. It is the wrong tool for limiting an individual IAM role’s permissions boundary.

Use a resource-based policy on Amazon S3 to restrict the permissions that IAM roles can receive.

Resource policies control access to the resource they are attached to, not the maximum permissions a role can hold across AWS services. They do not provide a general guardrail for IAM role creation or future policy attachment.

Require temporary STS session policies whenever the role is assumed.

Session policies can further reduce permissions for a specific session, but they depend on every caller behaving correctly each time the role is assumed. They are not a durable organizational ceiling for all future role sessions or policy attachments.

What does this SAA-C03 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Attach a permissions boundary to each role so the role can never exceed the approved ceiling. — A permissions boundary is the AWS control that caps a role’s maximum effective permissions. It acts as an upper limit that still applies even if someone attaches additional managed policies, inline policies, or other permissions later. That is exactly what security wants here: delegated role creation with a hard ceiling defined centrally and enforced per role. An SCP is useful as an account or organization-wide guardrail, but it is not the same as a per-role maximum permission boundary. Resource policies are scoped to individual resources and do not constrain IAM role creation. STS session policies are temporary and depend on each call, so they cannot reliably enforce the organization’s ceiling long term.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.