SAA-C03 Design Secure Architectures Practice Question
Your company allows application teams to create IAM roles. Each team must be prevented from granting permissions beyond a defined per-role baseline, even if they attach overly permissive identity-based policies to the role. Which AWS feature best enforces this ceiling at the IAM role level?
⚠ Common exam trap
A common mix-up: candidates confuse SCPs with permission boundaries, thinking SCPs can enforce per-role limits, but SCPs apply to all principals in an account and cannot be scoped to individual roles, whereas permission boundaries are specifically designed for that purpose.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attach a permission boundary to every role that teams create so the boundary limits the role’s maximum effective permissions
Permission boundaries are an AWS IAM feature that sets the maximum permissions that an identity-based policy can grant to an IAM role. When a permission boundary is attached to a role, the effective permissions are the intersection of the boundary and the role's identity-based policy, ensuring that even if a team attaches an overly permissive policy, the role cannot exceed the boundary's defined limits. This directly enforces a per-role ceiling on permissions, making option B the correct choice.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use an Organizations service control policy (SCP) to cap the maximum permissions for role creation in each account
Why it's wrong here
SCPs limit what principals in a member account can do, but they are applied at the account/organization level. They are not the most direct control to enforce a per-role permissions ceiling defined by the baseline that applies to each role the teams create.
When this WOULD be correct
An exam question asks: 'How can an organization ensure that no IAM role in any account can exceed a certain set of permissions, regardless of the policies attached to the role?' In that case, an SCP at the root or OU level would enforce a maximum permission ceiling across all roles in the account.
- ✓
Attach a permission boundary to every role that teams create so the boundary limits the role’s maximum effective permissions
Why this is correct
A permission boundary acts as a permissions ceiling for the role. Even if the team attaches an identity-based policy that grants broader permissions, the role’s effective permissions are only those allowed by both the identity policy and the permission boundary. This prevents privilege escalation by role policy changes while still allowing teams to manage which policies are attached, within the boundary.
- ✗
Rely on KMS key policies to restrict permissions because IAM policies cannot override KMS restrictions
Why it's wrong here
KMS key policies only govern access to a specific category of resources—encryption keys used with AWS Key Management Service—so they cannot cap permissions for actions on EC2, S3, or IAM itself. Even for KMS-sensitive operations, a key policy is a resource-based policy that works together with (and does not supersede) IAM policies; it allows or denies specific KMS API calls but does not establish a maximum permission envelope for the role. Therefore, relying on KMS policies would leave every non-KMS action unconstrained and fail to prevent the privilege escalation that application teams could introduce with broader role policies.
When this WOULD be correct
A question asking how to restrict which AWS KMS keys a role can use for encryption/decryption, where you need to ensure that even if an IAM policy grants broad KMS access, the key policy overrides it to deny access.
- ✗
Require multi-factor authentication (MFA) for all role creation requests and deny any request without MFA
Why it's wrong here
MFA strengthens authentication for the person creating the role, but it does not limit the permissions the role can actually exercise after it is created. Permission boundaries specifically enforce a maximum set of allowed actions for the role.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SAA-C03 exam frequently reuses these exact scenarios with slightly different constraints.
✓Attach a permission boundary to every role that teams create so the boundary limits the role’s maximum effective permissionsCorrect answer▾
Why this is correct
A permission boundary acts as a permissions ceiling for the role. Even if the team attaches an identity-based policy that grants broader permissions, the role’s effective permissions are only those allowed by both the identity policy and the permission boundary. This prevents privilege escalation by role policy changes while still allowing teams to manage which policies are attached, within the boundary.
✗Use an Organizations service control policy (SCP) to cap the maximum permissions for role creation in each accountWrong answer — click to see why▾
Why this is wrong here
SCPs apply to all principals in an account and cannot be scoped to individual roles; they set an account-wide ceiling, not a per-role boundary. The question requires a per-role limit, which SCPs cannot provide.
★ When this WOULD be the correct answer
An exam question asks: 'How can an organization ensure that no IAM role in any account can exceed a certain set of permissions, regardless of the policies attached to the role?' In that case, an SCP at the root or OU level would enforce a maximum permission ceiling across all roles in the account.
Why candidates choose this
Candidates know SCPs can cap permissions, so they mistakenly think they can be applied per role, overlooking that SCPs are account-wide and cannot differentiate between roles within an account.
✗Rely on KMS key policies to restrict permissions because IAM policies cannot override KMS restrictionsWrong answer — click to see why▾
Why this is wrong here
KMS key policies control access to encryption keys, not IAM role permissions. They cannot enforce a ceiling on the maximum permissions an IAM role can have, which is the requirement in this question.
★ When this WOULD be the correct answer
A question asking how to restrict which AWS KMS keys a role can use for encryption/decryption, where you need to ensure that even if an IAM policy grants broad KMS access, the key policy overrides it to deny access.
Why candidates choose this
Candidates may confuse permission boundaries with resource-based policies like KMS key policies, thinking that a restrictive key policy can cap permissions, but key policies only apply to the specific key, not to the role's overall permissions.
Analysis generated from the official SAA-C03blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
This SAA-C03 question is part of Courseiva's 935-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.