SAA-C03 Design Secure Architectures Practice Question
A retail company lets developers deploy ECS services but they must never be able to modify IAM. The team currently uses an IAM user per developer with an admin-like policy, and several access keys have been leaked. You are asked to redesign access so that: (1) developers authenticate with temporary credentials, (2) they can create/update ECS services and related autoscaling resources, and (3) IAM changes are impossible even if a developer tries to attach new policies.
Which design best meets all requirements?
⚠ Common exam trap
Many exam-takers think a permission boundary is optional or that denying iam:* actions in a policy is sufficient, but without a boundary, a developer could attach a new policy that grants iam:* actions, bypassing the deny—the boundary is required to cap permissions at the role level.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use an IAM role that developers assume for deployments; attach least-privilege policies for ECS and Auto Scaling; and attach a permission boundary that does not allow iam:* actions, so additional inline or managed policies cannot grant IAM permissions.
It uses an IAM role with temporary credentials (via AWS STS AssumeRole), satisfying the requirement that developers never have long-term access keys. The least-privilege policies restrict actions to ECS and Auto Scaling only, and the permission boundary explicitly denies iam:* actions, preventing developers from escalating privileges by attaching new policies to their role. This combination ensures developers can deploy ECS services but cannot modify IAM in any way.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an IAM user for each developer and keep the existing broad permissions, rotating keys every 90 days.
Why it's wrong here
Long-lived IAM user access contradicts temporary credentials requirements. Rotating keys reduces exposure but does not prevent repeated leakage or enforce least privilege at scale.
When this WOULD be correct
This option would be correct if the requirements were: (1) developers need programmatic access with long-term credentials, (2) key rotation is acceptable, and (3) there is no requirement to prevent IAM modifications or use temporary credentials.
- ✓
Use an IAM role that developers assume for deployments; attach least-privilege policies for ECS and Auto Scaling; and attach a permission boundary that does not allow iam:* actions, so additional inline or managed policies cannot grant IAM permissions.
Why this is correct
Assuming a role provides temporary credentials and removes long-lived keys. Least-privilege policies limit allowed actions, and a permission boundary caps the role's effective permissions so IAM actions cannot be gained through later policy changes.
- ✗
Attach a policy that allows ecs:* and autoscaling:* and rely on developers to self-review that no IAM statements are added to their roles.
Why it's wrong here
Self-review is not an enforceable control. Without a permission boundary or explicit deny, developers could add iam:* permissions and violate the security requirement.
When this WOULD be correct
In a scenario where developers are trusted to follow security guidelines and the requirement is only to provide least-privilege access without enforcing IAM restrictions, this self-review approach could be acceptable.
- ✗
Create a single shared IAM role with full administrator permissions so developers can troubleshoot faster when deployments fail.
Why it's wrong here
Administrator permissions violate least-privilege and allow IAM changes. A shared role also makes accountability weaker and increases blast radius of mistakes.
When this WOULD be correct
This option would be correct in a scenario where developers need unrestricted access for emergency troubleshooting in a sandbox environment, and the requirement for temporary credentials and IAM restriction is not present.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SAA-C03 exam frequently reuses these exact scenarios with slightly different constraints.
✓Use an IAM role that developers assume for deployments; attach least-privilege policies for ECS and Auto Scaling; and attach a permission boundary that does not allow iam:* actions, so additional inline or managed policies cannot grant IAM permissions.Correct answer▾
Why this is correct
Assuming a role provides temporary credentials and removes long-lived keys. Least-privilege policies limit allowed actions, and a permission boundary caps the role's effective permissions so IAM actions cannot be gained through later policy changes.
✗Create an IAM user for each developer and keep the existing broad permissions, rotating keys every 90 days.Wrong answer — click to see why▾
Why this is wrong here
Option A uses long-term IAM users with static keys, violating requirement (1) for temporary credentials. Rotating keys every 90 days does not prevent leaks between rotations and still allows permanent access, failing to meet the security goal.
★ When this WOULD be the correct answer
This option would be correct if the requirements were: (1) developers need programmatic access with long-term credentials, (2) key rotation is acceptable, and (3) there is no requirement to prevent IAM modifications or use temporary credentials.
Why candidates choose this
Candidates may think key rotation is sufficient for security and overlook the requirement for temporary credentials, or they may be accustomed to using IAM users for developer access.
✗Attach a policy that allows ecs:* and autoscaling:* and rely on developers to self-review that no IAM statements are added to their roles.Wrong answer — click to see why▾
Why this is wrong here
This option relies on developers self-policing their policies, which does not prevent them from accidentally or intentionally adding IAM permissions, violating the requirement that IAM changes be impossible.
★ When this WOULD be the correct answer
In a scenario where developers are trusted to follow security guidelines and the requirement is only to provide least-privilege access without enforcing IAM restrictions, this self-review approach could be acceptable.
Why candidates choose this
Candidates may think that granting only ECS and Auto Scaling permissions is sufficient, overlooking the need for a permission boundary to block IAM modifications, and assume developers will not escalate privileges.
✗Create a single shared IAM role with full administrator permissions so developers can troubleshoot faster when deployments fail.Wrong answer — click to see why▾
Why this is wrong here
Option D grants full administrator permissions, violating the requirement that developers must never be able to modify IAM. It also uses a single shared role with permanent credentials, contradicting the need for temporary credentials and least privilege.
★ When this WOULD be the correct answer
This option would be correct in a scenario where developers need unrestricted access for emergency troubleshooting in a sandbox environment, and the requirement for temporary credentials and IAM restriction is not present.
Why candidates choose this
Candidates may think full admin access simplifies troubleshooting and deployment, overlooking the security requirements for temporary credentials and IAM restrictions.
Analysis generated from the official SAA-C03blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
One of 302 original SAA-C03 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.