SAA-C03 Design Secure Architectures Practice Question
Your CI system assumes an IAM role RoleForDeploy using STS AssumeRole and includes a session tag called Project=blue. The role’s permissions policy uses an ABAC condition like aws:PrincipalTag/Project to allow access only to resources tagged with the same project.
AssumeRole succeeds, but deployments fail with AccessDenied. CloudTrail shows the role was assumed, yet the effective session does not contain the Project tag.
Which change most directly fixes this issue?
⚠ Common exam trap
A common mix-up: candidates assume session tags are automatically applied when passed in the AssumeRole call, but AWS requires explicit `sts:TagSession` permission for the tags to take effect, which is a subtle but critical detail tested in ABAC scenarios.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add permissions for sts:TagSession to the IAM role so the CI pipeline is allowed to pass the Project session tag during AssumeRole.
When an IAM role is assumed with STS AssumeRole and session tags are included, the calling principal must have explicit permission to pass those tags via the `sts:TagSession` action. Without this permission, the session tags are silently dropped, even though the AssumeRole call succeeds. Adding `sts:TagSession` to the role's permissions allows the CI pipeline to pass the `Project=blue` tag, making the ABAC condition on `aws:PrincipalTag/Project` evaluate correctly and granting access to tagged resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Add permissions for sts:TagSession to the IAM role so the CI pipeline is allowed to pass the Project session tag during AssumeRole.
Why this is correct
Session tags are not automatically granted; the role needs sts:TagSession permission to allow passing tags into the session.
- ✗
Remove the ABAC condition using aws:PrincipalTag/Project so the policy ignores session tags.
Why it's wrong here
Removing the condition would broaden access and violates the ABAC design that restricts actions to the correct project.
- ✗
Move the aws:PrincipalTag/Project condition into the trust policy so it applies during the AssumeRole call.
Why it's wrong here
Even if conditions exist in the trust policy, the session tags must be allowed and provided. The failure indicates the tag was not populated.
- ✗
Add kms:Decrypt permission to the CI role because missing tags are typically caused by KMS authorization failures.
Why it's wrong here
The observed symptom is that the session tag is missing, not that KMS decryption is denied. These are unrelated controls.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
This SAA-C03 question is part of Courseiva's 302-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.