Your AWS Organization uses a Service Control Policy (SCP) that includes a Deny statement for secretsmanager:GetSecretValue for all member accounts in the "Finance" OU when requests are made outside us-east-1. An application role has an IAM policy that allows secretsmanager:GetSecretValue for the required secret in us-west-2. In us-west-2, requests fail with AccessDenied. What is the most appropriate action?

Update the application role IAM policy to include us-west-2 in the resource ARN.

SCPs define the maximum permissions allowed at the organization/account level. An SCP explicit Deny overrides IAM allows, so modifying only the role’s identity policy cannot fix an SCP-driven AccessDenied.

Create a permission boundary that removes the deny behavior for the member account.

Permission boundaries restrict what a role can do, but they do not override org-level SCP restrictions. The account still must comply with the SCP Deny.

Use sts:AssumeRole into another account that is not in the Finance OU to bypass the SCP.

AssumeRole does not bypass SCPs. The effective authorization is still evaluated using the caller’s organization/account context and SCPs that apply to the target and/or calling principal context. SCP Deny restrictions cannot be circumvented by role assumption alone.

What does this SAA-C03 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Modify the SCP to allow secretsmanager:GetSecretValue in us-west-2 for the Finance OU (if that aligns with policy intent), or move the workload to us-east-1. — SCPs set the permissions boundary for the organization (including explicit Deny statements). If the SCP denies secretsmanager:GetSecretValue for requests outside us-east-1 for accounts in the Finance OU, then IAM allows in the role policy do not take effect. The most appropriate action is to modify the SCP to permit the needed region (if intended) or move the workload to us-east-1 so requests comply with the SCP. A is insufficient because IAM cannot override an SCP Deny. B is incorrect because permission boundaries do not change org/account-level SCP evaluation. D is incorrect because AssumeRole cannot bypass SCP restrictions; authorization still reflects SCP controls.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.