Your company allows application teams to create IAM roles. Each team must be prevented from granting permissions beyond a defined per-role baseline, even if they attach overly permissive identity-based policies to the role. Which AWS feature best enforces this ceiling at the IAM role level?

Use an Organizations service control policy (SCP) to cap the maximum permissions for role creation in each account

SCPs limit what principals in a member account can do, but they are applied at the account/organization level. They are not the most direct control to enforce a per-role permissions ceiling defined by the baseline that applies to each role the teams create.

Rely on KMS key policies to restrict permissions because IAM policies cannot override KMS restrictions

KMS key policies primarily govern usage of specific KMS keys (for example, Encrypt/Decrypt) and do not provide a general, cross-service cap on what an IAM role can do.

Require multi-factor authentication (MFA) for all role creation requests and deny any request without MFA

MFA strengthens authentication for the person creating the role, but it does not limit the permissions the role can actually exercise after it is created. Permission boundaries specifically enforce a maximum set of allowed actions for the role.

What does this SAA-C03 question test?

Standard ACLs match source addresses.

What is the correct answer to this question?

The correct answer is: Attach a permission boundary to every role that teams create so the boundary limits the role’s maximum effective permissions — Attach a permission boundary to each role. Permission boundaries are evaluated as an upper limit on what the role can do: the role’s effective permissions are the intersection of (1) the identity-based policies attached to the role and (2) the permissions allowed by the boundary. Therefore, even if teams attach overly permissive policies to a role, the boundary prevents the role from exceeding the defined baseline. Why others are wrong: SCPs are organization/account-level guardrails, not a per-role permissions ceiling. KMS key policies restrict KMS operations for specific keys rather than enforcing a general IAM permissions cap across services. MFA controls who can create the role, not what the role can do once created.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.