SAA-C03 Design Secure Architectures Practice Question
Exhibit
Current IAM policy attached to arn:aws:iam::123456789012:role/AppProvisioner: - iam:CreateRole - iam:AttachRolePolicy - iam:PutRolePolicy - iam:PassRole Observed issue: Developers created arn:aws:iam::123456789012:role/BatchJobRole and attached broad S3 and KMS permissions. Audit note: "Need delegated role creation with a hard upper bound on permissions."
Based on the exhibit, the platform team wants developers to create application roles for Lambda and ECS, but no developer-created role may ever exceed the approved permission set. Which change best meets this requirement?
⚠ Common exam trap
Many exam-takers confuse reactive monitoring (like CloudTrail alerts) with preventive controls, or mistakenly think network isolation (VPC/security groups) can restrict IAM permissions, when only IAM boundaries or service control policies (SCPs) can cap permissions at the identity level.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attach a permissions boundary strategy to the delegated workflow and require every created role to include that boundary using the iam:PermissionsBoundary condition.
It uses an IAM permissions boundary attached to the delegated role creation workflow, combined with the `iam:PermissionsBoundary` condition key to enforce that every developer-created role must include that boundary. This ensures no role can exceed the approved permission set, as the boundary acts as a maximum limit on permissions, even if the role's policy grants more. The delegated workflow (e.g., AWS Service Catalog or IAM Role creation via Lambda) can create roles, but the boundary prevents any escalation beyond the predefined scope.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Remove all IAM permissions from AppProvisioner and require a central security team to create every role manually.
Why it's wrong here
This would certainly reduce risk, but it removes the delegated administration model the team explicitly needs. It is operationally expensive and slows delivery unnecessarily.
- ✓
Attach a permissions boundary strategy to the delegated workflow and require every created role to include that boundary using the iam:PermissionsBoundary condition.
Why this is correct
A permissions boundary creates an upper limit on what any developer-created role can ever do, even if someone later attaches broader policies. Requiring the boundary during role creation prevents privilege escalation while still allowing delegated self-service for approved application roles. This is the standard AWS pattern when teams need to create roles but must remain inside a strict security envelope.
- ✗
Allow developers to keep creating roles, but add a CloudTrail rule that alerts security after a privileged policy is attached.
Why it's wrong here
Alerting after the fact detects bad changes, but it does not prevent a powerful role from being created or used. The requirement is preventive least privilege, not detective monitoring alone.
- ✗
Move the delegated IAM workflow into a separate VPC and restrict it with security groups and network ACLs.
Why it's wrong here
IAM authorization is not controlled by VPC networking constructs. Security groups and network ACLs do not restrict IAM actions such as role creation or policy attachment.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAA-C03 question from scratch — 302 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.